NAFCU Compliance Blog

We Listened So You Don’t Have To: NCUA Panel Discussion on Reaching Hispanic Members; Post-Turkey Day Regulator Round-Up; What Dog Is This?

Written by Elizabeth M. Young LaBerge, Regulatory Compliance Counsel

I hope everyone had a wonderful Thanksgiving. Last week felt like a short one to me, but it appears that NCUA and the CFPB managed to cram in a full weeks’ worth of regulatory news. Here’s a quick catch-up:

NCUA Panel Discussion on Reaching Hispanic Members

Yesterday afternoon, NCUA held a panel discussion, “Unique Challenges and Opportunities Servicing Hispanic Credit Union Members,” which emphasized the opportunities for credit unions that currently exist within the Hispanic population, and, importantly, practical, useful guidance and suggestions on what credit unions can do to engage potential Hispanic members.

The panel discussed common pitfalls in engaging potential Hispanic members, including the use of CIP policies or procedures which do not accommodate the documentation which can be provided by new immigrants. The panelists, including Sergio Osuna, a Supervisory Examiner for NCUA’s Region V Office, specifically referenced the matrícular consular, an identification card issued by a Mexican consulate, in place of U.S. government issued identification. The panel recommended that credit unions that wish to engage first-generation Hispanic immigrants, approximately half of which are either unbanked or underbanked, speak with the consulates of the relevant populations in their community to determine appropriate foreign government-issued identification.

The panelists also discussed underwriting loans for members who do not have social security numbers, marketing and engagement strategies, products to which Hispanic members respond, best practices for serving Hispanic members and field of membership considerations for adding Hispanic communities to a credit union’s charter. Any credit union which is considering outreach to Hispanic members of its community should consider giving the panel discussion a watch. It will be available via NCUA’s website in 4-5 weeks.

Post-Turkey Day Regulator Round-Up

CFPB Monthly Complaint Snapshot

On November 24, 2015, the CFPB released its monthly consumer complaint snapshot report. The November complaint report highlighted bank account and service complaints. It reported an increase in CFPB complaints pertaining to prepaid products ― though debt collection, credit reporting and mortgage complaints continued to be the most-complaint-about issues. The regional focus of the November report was on Connecticut and the Hartford metro area.

Adjustment of Dollar Thresholds in Regulations Z and M

On November 25, 2015, the CFPB announced that the thresholds for transaction exemptions under regulations Z and M will not be adjusted from the 2015 level of $54,600. The notice submitted to the Federal Register for Regulation Z is here, and the notice for Regulation M is here.

Adjustment of Threshold for Exemption from Appraisal Requirements

Also on November 25, 2015, the CFPB announced that the threshold amount for loans exempt loans from special appraisal requirements for higher-priced mortgage loans under 12 C.F.R. § 1026.35(c)(2)(ii) will also remain the same as it did for 2015: $25,500. The notice submitted to the Federal Register is here.

NCUA Debuts New Share Insurance Videos

On November 30, 2015, NCUA announced the release of three new videos directed at consumers to help them understand their insurance coverage on their deposits. The videos include a Share Insurance Coverage Overview, How to Use NCUA’s Share Insurance Estimator and Account Ownership Types.

A Christmas Surprise: What Dog Is This?

I have mentioned my dogs, Boomer and Ollie, in previous blog posts. Ollie is former stud dog rescued from a Pennsylvania puppy mill. Originally, the rescue organization advised us he was a one-year old bichon frise. When we arrived in Shamokin, Pennsylvania, we realized pretty quickly that was not the case. To date, every vet we’ve been to has had a different guess. We have finally buckled down and ordered a genetic test to determine his breed. Is little Ollie just a Maltese with a bad haircut? Or is he a Coton De Tulear, the royal dog of Madagascar? Only time and genetic testing will tell. Let me know if anyone has a guess ― the results should arrive around Christmas. Claiming to be right after the fact does not count!

Smart Tech App Touts Ease of Obtaining Bank Accounts; Programming Note

Written by Shari R. Pogach, Regulatory Paralegal

Recently immigrated to the United Kingdom and don’t have a bank account? Do you have the following? A passport picture? A selfie? A smartphone? Well, you’re in luck, because with this new start-up company’s app, you can open up a bank account in as little as three (3) minutes with just a passport picture, a selfie and your smartphone.

The community website Business Insider has done a series of posts on the London-based start-up Monese. The company is targeted to newly arrived migrants who don’t yet have a financial footprint in their new location. Monese’s website states “you can open a UK banking account on your mobile in minutes, regardless of your citizenship.” As of October 2015, it had a waiting list of 56,000 applicants.

The company does not hold a banking license; rather it works with banks across Europe that hold a customer’s money. Monese has an e-money license that is issued by the United Kingdom’s Financial Conduct Authority and allows the company to digitally hold a customer’s money.

Once a customer applies and the application is approved, Monese sends the customer a Visa debit card. The customer can then link that card to the app and use it like any other debit card.

The Monese identity checking platform circumvents the Customer Identification Program (CIP) and “know your customer” regulatory hoops that U.S. financial institutions must follow. But the company insists: “We are members of a number of anti-fraud, anti-money laundering, and counter terrorist data-sharing networks which helps us to play our part in maintaining public safety effectively. We ensure that none of the customers who apply for Monese accounts are on a designated list or have any black marks for criminal activity against their identity.”

How do they do this? By checking a customer’s social networking footprint, using geo-location to perform additional checks and online video verification through Skype interviews. The company states: “The use of online video verification is also used to provide an additional level of verification if all else fails. The video chat which we conduct with customers over Skype is similar to an in-branch account opening experience with a high-street bank, except customers can do it from the comfort of their own house. All in all opening an account with Monese takes under 3 and in that short time we are able to run all of the checks required to feel comfortable that we know the person that has joined our service very well.”

Really?

***
Programming Note:  NAFCU will be closed for the Thanksgiving holiday this Thursday and Friday but we’ll be back to blogging on Monday, November 30.

Whatever you may be thankful for and however you may celebrate, from all of us here at NAFCU, may you and yours have a:

HMDA—Institutional Coverage Test in 2017 and Beyond; BSA Blast Available

Written by Brandy Bruyere, Director of Regulatory Compliance

As Alicia mentioned on Friday, the CFPB finalized changes to HMDA on Thursday, October 15^th. Most of the rule such as new data points will not become effective until January 2018. However, the definition of “financial institution” is changing effective January 1, 2017 to incorporate one prong of the “institutional coverage” test, so I thought I would highlight that today and keep the blog short for a Monday morning.

Section 1003.2 contains a definition of financial institution that determines which credit unions must report under HMDA as applicable. Part (1) of this definition will have a fifth subpart added to include a threshold test so if a credit union does not meet another exclusion under the rule, it may still be exempt from reporting by not originating a threshold number of loans. Here is how this section of the rule will appear as of January 1, 2017:

“Financial institution means:

(1) A bank, savings association, or credit union that:

[…]

(v) In each of the two preceding calendar years, originated at least 25 home purchase loans, including refinancings of home purchase loans, that are not excluded from this part pursuant to § 1003.4(d)…”

See p. 653 of the final rule.

Meanwhile, the definition that becomes effective on January 1, 2018 will incorporate second prong which would also include those credit unions that originated at least 100 open-end lines of credit in each of the two preceding calendar years. Of course, the rule is written in a rather convoluted way, so as I continue to dig through more, I feel a bit like this:

 

Keep in mind that the final rule makes amendments to the official staff commentary as well, although none of these changes are effective until January 1, 2018. However, here’s the amended staff commentary to this particular test which does provide some clarification as to which loans count towards this threshold:

“5. Originations. Whether an institution is a financial institution depends in part on whether the institution originated at least 25 closed-end mortgage loans in each of the two preceding calendar years [January 1, 2017] or at least 100 open-end lines of credit [January 1, 2018] in each of the two preceding calendar years. Comments 4(a)-2 through -4 discuss whether activities with respect to a particular closed-end mortgage loan or open-end line of credit constitute an origination for purposes of § 1003.2(g).”

See p. 695 of the final rule.

(emphasis added)

NAFCU is working on a Final Regulation summarizing key parts of the rule that will be made available to members within a couple of weeks.

***

BSA Blast.   The October 2015 quarterly issue of the BSA Blast is now available for NAFCU members (member login needed).  This quarter, we review how the Department of Treasury’s Office of Foreign Assets Control’s final rule amending the Cuban sanctions changes things for financial institutions.  In addition, there is a new BSA quiz on Anti-Money Laundering compliance programs and Bank Secrecy Act reporting that can be used for staff training.

IRS Resource - Money Laundering Case Investigations

Written by Shari R. Pogach, Regulatory Paralegal

I always like to come across useful information that can be used for training purposes.  For instance I just discovered that the Internal Revenue Service (IRS) has a nifty listing of examples of money laundering investigations on its website.  These listings come from public record documents filed in the courts where the cases were prosecuted.  The cases involve the standard drug trafficking, elder abuse, fraud, Ponzi schemes, etc.  But under the fiscal year 2015 investigations, I found two that I’d like to highlight as they both directly involve financial institutions: 1) an example of structuring to avoid currency transaction reporting and 2) ATM theft by the company servicer.

Case Example #1:

“North Carolina Man Sentenced for Structuring Financial Transactions

On April 27, 2015, in Raleigh, North Carolina, James Dino Wills, of Wilson, North Carolina, was sentenced to 102 months in prison, three years of supervised release and ordered to forfeit $733,882. Wills also agreed to file amended federal income tax returns for the tax years 2008 through 2013 and to pay any taxes owed. Wills pleaded guilty on May 7, 2014 to structuring financial transactions to evade the filing of currency transaction reports (CTRs). Federal law requires banks and other financial institutions to file CTRs with the U.S. Treasury Department for all cash transactions exceeding $10,000. According to court documents, Wills operated a business in the Rocky Mount and Wilson, North Carolina areas from 2008 to 2013 and received payments for services primarily in the form of checks. These checks were deposited into his business accounts at two financial institutions. Wills then structured cash withdrawals from these accounts in order to avoid the filing of CTRs. From 2008 to 2013, he structured $755,764 in cash transactions. Wills was prosecuted for the same offense in 1998.” (Emphasis added.)

Case Example #2:

“Missouri Man Sentenced for Stealing Money from ATMs

On Nov. 18, 2014, in Kansas City, Missouri, Anthony T. Civella, Jr., was sentenced to 24 months in prison and ordered to pay $70,000 in restitution, in addition to the restitution that has already been paid. On Feb. 27, 2014, Civella pleaded guilty to bank larceny and money laundering. According to court documents, from 2011 through 2013, Civella owned and operated a company called C Management Group, LLC, which serviced 35 ATMs in the Kansas City, Missouri, metropolitan area. Civella stole $330,040 from the ATMs by obtaining a maintenance code to access the machines. Civella moved money between the ATM machines in order to conceal the theft from the bank. He then comingled the stolen money from the ATMs by depositing most of the cash into his personal checking account at a credit union.”  (Emphasis added.) 

Hopefully these IRS money laundering real world examples of criminal activity can enhance your existing training tools for Bank Secrecy Act education for your staff.  

Friday FinCEN Update

Written by Brandy Bruyere, Director of Regulatory Compliance

It’s been a bit of a slow week, but when you work in compliance sometimes no news is good news. After all, that means no new rules to learn this week, right? Today I’d like to highlight two items that recently came out of FinCEN—a proposed rule that would require “investment advisers” to adopt formal Anti-money laundering (AML) programs and report suspicious activity, and a FinCEN consent order involving Caesar’s Palace.

FinCEN Proposal. A few of our members have asked about this proposed rule so here’s a very brief overview. On Tuesday, September 1st, FinCEN published a proposed rule that would extend particular Bank Secrecy Act (BSA) requirements to investment advisers. Specifically, under this proposal, an investment advisor would be required to establish written AML programs, report suspicious activity to FinCEN and follow recordkeeping requirements. 

Keep in mind that federal credit unions cannot directly offer products like securities, but there are some FCUs that have relationships with CUSOs which sell products like securities. Thus, this proposal may impact a credit union more tangentially, such as through due diligence obligations with regards to third-party relationships. However, the proposal defines “investment adviser” as “[a]ny person who is registered or required to register with the SEC under section 203 of the Investment Advisers Act of 1940…” Thus, whether this rule impacts a particular credit union’s relationships will depend in large part on if any of a credit union’s CUSOs have obligations to register with the Securities Exchange Commission under this cross-referenced statute. This is not the first time FinCEN has issued such a proposal, so time will tell if or when this could be finalized.

FinCEN and Caesars Palace Reach Settlement. While not specific to credit unions, this story caught my eye given some of the facts surrounding the case. Caesars Place, which earlier this year filed for Chapter 11 bankruptcy, agreed to pay an $8 million civil money penalty and implement changes to its BSA/AML program. The case involves allegations that the casino had “systemic and severe AML compliance deficiencies” particularly with its private gaming salons reserved for the wealthiest of gamblers who provided a minimum “front money deposit” of $300,000. According to the consent order, it was not uncommon for this high-end clientele to gamble “millions of dollars in a single visit.” Must be nice, right? I have a hard enough time purchasing a lottery ticket! But back to FinCEN…

The casino permitted wealthy patrons to gamble anonymously without “appropriate [AML] scrutiny” that would “meet these heightened risks” and “failed to file over 100 SARs” for a variety of suspicious activities including potential money laundering. As part of the consent order, Caesars agreed to several conditions:

• undertake improvements to its BSA/AML program, including “fostering a culture of compliance;”
• retain a qualified external auditor to perform independent reviews of its program;
• properly train staff;
• perform a “SAR lookback” and file as necessary after reviewing the deficient time period; and
• report to FinCEN annually for three years.

While this case involves a casino, sometimes these kinds of conditions from a consent order can be useful as illustrations of regulatory expectations.

Enjoy Friday and have a great weekend!

Hair Show Scam

Written by Shari R. Pogach, Regulatory Paralegal

To wind down the last few lazy days of summer, I thought I’d share this unusual financial fraud case I found on the FBI’s website.  You just can’t make this stuff up.

Tamira Fonville and her partner, Ricardo Falana, would go up and down the Interstate 95 corridor from New York to Washington, DC.  They would go to shopping malls and target the young college-age women who spent time there.  Using fake names, Fonville would recruit women to participate in a supposedly upcoming hair show.  She would talk up the hair show and offer to pay the women for their services to participate.  But in order to pay the young women she required their debit card numbers and access to their accounts.  Then Falana would deposit bogus checks into the legitimate accounts and immediately withdraw them before the bank realized the fraud. 

According to the FBI investigator on the case, Special Agent Sean Norman, Fonville and Falana made a lot of money for several years.  Banks and other financial institutions lost approximately $600,000.  This is how the scam would go down:        

“On a typical recruiting trip, Fonville might talk with 20 or 30 women and would follow up with text messages using disposable phones whose numbers could not be traced. If she ended up with three or four willing participants, that was enough.

‘Some took the hair show bait and handed over their debit cards and PINs,’ Norman said. ‘Others who were skeptical got a different pitch,’ he explained. ‘They were told: ‘I can make money appear in your account. You will get some money, I will get some money, and the bank won’t lose anything.’

With access to legitimate accounts not tied to him, Falana deposited forged checks of up to $10,000 and then withdrew money before the bank realized the checks were bad. Many of the victims were coached to tell bank investigators that their debit cards had been stolen and their PINs were written on the cards.

‘The majority of the account holders knew they were doing something fraudulent,’ Norman said. ‘They thought they were going to get something out of it, but they got nothing.’”

Court documents indicate that between 2008 and 2013, Fonville personally benefited to the tune of more than $230,000.  Fonville even told investigators she viewed the scam as a career.

Fonville and Falana pled guilty to bank fraud charges and went to prison.  Fonville was sentenced to 15 months and Falana to 80 months. 

What will they think of next? 

Strong BSA/AML Program Criteria; Unusual DC Beach

Written by Shari R. Pogach, Regulatory Paralegal 

Last month I attended the 2015 Mid-Atlantic Anti-Money Laundering (AML) Conference, a two-day symposium sponsored by ICE/Homeland Security Investigations, the Federal Bureau of Investigation (FBI), the Drug Enforcement Administration (DEA) and the United States Secret Service (USSS).  This conference gives law enforcement agency, regulatory agency and financial industry representative attendees the chance to focus on money laundering trends, successful enforcement investigations and lessons learned.  One panel discussion by representatives from the Federal Reserve, the Federal Deposit Insurance Corporation (FDIC) and the Office of the Comptroller of the Currency covered Bank Secrecy Act (BSA) from a financial regulator’s perspective.  While the discussion covered banks as there have been a number of significant BSA enforcement actions against banks of late, I think some of the points brought up by the panelists are useful.

Apparently the majority of deficiencies in BSA programs found through bank examinations result from a series of interrelated processes and internal controls, i.e., a weakness with one control leads to other weaknesses. The panel stressed that regulators were not out to perform “gotchas” in looking for deficiencies but rather that an institution was expected to maintain a meaningful risk assessment methodology to ensure: 1) appropriate risk-rating of customers, products and services; 2) the proper monitoring and management of actual risks; 3) the detection and reporting of suspicious activity; and 4) the limitation of exposure and prevention of money laundering or terrorist financing. An institution’s board should be continuously advised of changing risk levels.  Other BSA program deficiencies concerned suspicious activity reports (SARs) – such as not documenting why a SAR was not being filed and not properly adjusting changing SAR criteria/parameters, rather than  just using “off the shelf” monitoring criteria.   

The panel also provided the criteria for a strong BSA/AML program:

• Low turnover, an experienced, trained BSA officer and management;
• Repercussions for unethical behavior by personnel;
• A clear BSA/AML risk appetite;
• Directors are trained/apprised of BSA/AML issues;
• BSA officers are brought in early and often to assist with product development;
• BSA staff are engaged with all business lines;
• The ability to identify across an institution the BSA/AML risk in its customer base, products and services;
• Risk measurement and management associated with products and services;
• Trained and informed directs;
• Comprehensive policies, procedures and practices;
• Thorough and ongoing due diligence of customer base; and
• An understanding of customer business models.

Bottom line, an institution should have a strong risk management and compliance culture, perform effective due diligence and have an effective suspicious activity monitoring program.

***

NAFCU Webcast.  What’s New and What’s Next with NAFCU’s Regulatory Affairs Team - Thursday, August 20, 2:00 – 3:30pm EST. Absorb the latest updates from the CFPB and NCUA and ensure your credit union is prepared for new and upcoming changes. NAFCU’s Regulatory Affairs team is here to provide you with the tools and knowledge you need to keep your credit union playing by the rules.

*** 

Unusual DC Beach.  So I’m sure most of you think we’re a little wacky here in Washington, DC.  Well, maybe we are?  One of my colleagues and I went to this beach party in DC this past Tuesday evening.  Yes, you are looking at an actual exhibit in the National Building Museum in the heart of Washington, DC called the BEACH and here it is:

Make an Impact and Become an Advocate; July Issue of BSA Blast

Written by Dan O’Brien, Director of Political Affairs

On Monday, NAFCU launched a new and improved Grassroots Action Center to better serve credit union professionals, like you, in your efforts to engage with your members of Congress.  We understand that the demands of the compliance community continue to increase day-by-day as federal regulators such as the CFPB and NCUA continue to finalize the plethora of regulations from Dodd-Frank. NAFCU wants to be a resource to help your voice be heard, which is why we developed these essential grassroots resources to make it easier for you to weigh in with your members of Congress and to be an advocate for the industry. The more they hear from you, their constituents, the more attention they will pay to the ever increasing regulatory burdens of credit unions.

You can have an impact on legislation by participating in grassroots advocacy and have input into the collective voice.  The outcome on an issue is often won, lost, delayed or altered by a robust grassroots advocacy program. Our advocacy efforts are made stronger by the skills and expertise of our members.  As the director of political affairs, I want NAFCU’s grassroots efforts to be broad and diverse in participation.  We need compliance experts to share their invaluable firsthand knowledge about the unnecessary burdens over-regulation is placing on credit unions.

Please to go to NAFCU’s Grassroots Action Center today and contact your members of Congress.  Encourage them to support and cosponsor key pieces of legislation like the Credit Union Risk-Based Capital Study Act of 2015 (H.R. 2769), the National Credit Union Administration Budget Transparency Act (H.R. 2287) and the Data Security Act of 2015 (H.R. 2205 and S. 961). All these bills cover different portions of NAFCU’s Five Point Plan for Regulatory Relief.  Share your stories about regulatory burdens and how they are impacting your credit union with your members of Congress. It will help NAFCU’s lobbyists in their legislative efforts, strengthen our advocacy and show Congress that we are serious about enacting real relief for our nation’s credit unions.

If you have any interest in learning more about NAFCU’s grassroots advocacy efforts, you can email me directly at [email protected].  Please remember to come join the fight for regulatory relief at NAFCU’s 2015 Congressional Caucus from September 14-17, 2015, in Washington, DC.  Click here to find out more!

Thanks in advance for your participation in legislative process.

***

BSA Blast.   The July 2015 quarterly issue of the BSA Blast is now available for NAFCU members (member login needed).   This edition takes a look at the Financial Crimes Enforcement Network’s enforcement action against a $94 million asset-sized WVA bank for willful Bank Secrecy Act and anti-money laundering violations.  There is also a review of the Department of Treasury’s 2015 report on the money laundering vulnerabilities and risks to the U.S. financial system.  The July 2015 issue also includes a new BSA quiz.

FinCEN’s Customer Due Diligence Rule May Be Finalized Later This Summer; National Money Laundering Risk Assessment and National Terrorist Financing Risk Assessment

Written by Bernadette Clair, Senior Regulatory Compliance Counsel

FinCEN’s Customer Due Diligence Rule May Be Finalized Later This Summer. According to the Spring 2015 Semiannual Unified Regulatory Agenda (Agenda), FinCEN may be releasing a final Customer Due Diligence (CDD) rule later this summer. Dates listed in the Agenda are tentative, and may change, but final action on this rule is currently noted for August 2015.  This CDD rule has been in the works for some time, and if finalized as proposed, would amend existing rules to include explicit CDD requirements, including a requirement to identify beneficial owners of legal entity customers, subject to certain exemptions. For additional details on the proposed rule, check out our previous blog post.

Another item of note from FinCEN on the Agenda that caught my eye –

There is a potential proposal in the works regarding reporting requirements for cross-border electronic transmittals of funds. Back in 2010, there was a proposal to require certain financial institutions to report transmittal orders associated with certain cross-border electronic transmittals of funds to FinCEN. That proposal generated a lot of feedback and was not finalized, however it looks like FinCEN may be issuing another notice of proposed rulemaking in August.

***

National Money Laundering Risk Assessment and National Terrorist Financing Risk Assessment.  Last week, Treasury released the National Money Laundering Risk Assessment and National Terrorist Financing Risk Assessment.  Intended to help the public and private sectors more effectively detect and combat illicit finance, these assessments provide a review of money laundering and terrorist financing methods used in the U.S., the risks these activities pose to the U.S. financial system and national security, and an update on current efforts to combat illicit finance.

Here’s a snippet from page 3 of the National Money Laundering Risk Assessment, discussing vulnerabilities:

“The size and sophistication of the U.S. financial system accommodates the financial needs of individuals and industries globally. The breadth of products and services offered by U.S. financial institutions, and the range of customers served and technology deployed, creates a complex, dynamic environment in which legitimate and illegitimate actors are continuously seeking opportunities.

This assessment finds that the underlying money laundering vulnerabilities remain largely the same as those identified in the 2005 United States Money Laundering Threat Assessment. The money laundering methods identified in this assessment exploit one or more of the following vulnerabilities:

• Use of cash and monetary instruments in amounts under regulatory recordkeeping and reporting  thresholds;

• Opening bank and brokerage accounts using nominees to disguise the identity of the individuals who control the accounts;

• Creating legal entities without accurate information about the identity of the beneficial owner;

• Misuse of products and services resulting from deficient compliance with anti-money laundering obligations; and

• Merchants and financial institutions wittingly facilitating illicit activity.”

Both reports are well worth a read for anyone with Bank Secrecy Act program management responsibilities.

FinCEN Update

Written by Shari R. Pogach, Regulatory Paralegal  

Enforcement Action. Earlier this month, the Financial Crimes Enforcement Network (FinCEN) announced its first civil enforcement action against a virtual currency exchanger.  Ripple Labs Inc. (Ripple) and its wholly- owned subsidiary, XRP II, LLC (formerly known as XRP Fund II, LLC) was assessed a $700,000 civil money penalty for acting as a money services business (MSB) and selling its virtual currency, known as XRP, without registering with FinCEN as well as not having an adequate anti-money laundering (AML) program in place.  Headquartered in San Francisco, CA, Ripple facilitated transfers and provided virtual currency exchange transaction services.  By market capitalization, Ripple cryptocurrency is second only to Bitcoin as of 2015. 

As part of an agreement for corrective action and to ensure future BSA compliance, Ripple must: 1) only transact XRP and “Ripple Trade” activity through a registered MSB; 2) implement and maintain an effective AML program; 3) comply with the Funds Transfer and Funds Travel Rules; 4) conduct a three-year “look-back” to require suspicious activity reporting for prior suspicious transactions; and 5)  retain external independent auditors to review compliance with the BSA every two years up to and including 2020. These reports will be provided to FinCEN and the U.S. Attorney's Office. Ripple is also required to take steps to appropriately monitor all future transactions. 

***

Speech Tidbits.  In a recent speech, FinCEN Director Jennifer Shasky Calvery discussed the agencies reliance on reports filed by financial institutions.  Some highlights:

“Thanks to the reports filed by financial institutions, FinCEN has a wealth of data that we are able to analyze and disseminate in the form of financial intelligence to our Treasury colleagues; and to law enforcement and intelligence community partners. The information you provide allows us to  connect the dots between seemingly unrelated individuals and entities. These capabilities are critical in supporting the U.S. Government’s efforts to disrupt ISIL sources of revenue, to restrict  their access to the international financial system, and to impose sanctions on ISIL facilitators.”

         […]

“Thanks to the reports filed by financial institutions, FinCEN has a wealth of data that we are able   to analyze and disseminate in the form of financial intelligence to our Treasury colleagues; and to law enforcement and intelligence community partners. The information you provide allows us to connect the dots between seemingly unrelated individuals and entities. These capabilities are critical in supporting the U.S. Government’s efforts to disrupt ISIL sources of revenue, to restrict their access to the international financial system, and to impose sanctions on ISIL facilitators.”

         […]

“…At FinCEN, we are working on multiple fronts to optimize the collection, analysis, and dissemination of your reporting to achieve these ends.”

         […]

 “We process about 50,000 new filings each day. To manage a data collection of this size, FinCEN   uses automated “business rules” to search the reporting daily for key terms, entities, or typologies specific interest. The rules are designed to screen daily filings and identify reports that merit   further review by analysts. For example, rules related to ISIL, alone, generate over 800 matches each month for further review and exploitation. “

         […]

“Domestically, FinCEN grants more than 10,000 agents, analysts, and investigative personnel from over 350 unique agencies across the U.S. Government with direct access to your reporting so that it gets the broadest possible use”

         […]

“To support follow-on action by others, FinCEN works closely with our Treasury colleagues within the Office of Foreign Assets Control (OFAC) to support their efforts to target sanctions on ISIL facilitators and deter a wide range of threats.”

In another speech, Shasky Calvery gave an update on the status of the agency’s enhanced customer due diligence proposal.

 “…Beneficial ownership information is so important to our efforts to enhance financial transparency, particularly as it relates to the issues we have discussed this morning surrounding money laundering through real estate and third party money launderers.”

         […]

“As far back as 10 years ago when I was working as a prosecutor, so many of my very own investigations were stalled by an inability to follow the money. And inevitably shell companies were involved. So when people ask “why beneficial ownership” and “why now?” what I really want to say is “why not 10 years ago?”

We all benefit from a level-playing field that requires all financial institutions to employ reasonable efforts to enhance the integrity of their institutions and the financial system as a whole. As most of you know, in July 2014, FinCEN working closely with its partners in Treasury issued an NPRM to amend existing BSA regulations to help prevent the use of shell and shelf companies to engage in or launder the proceeds of illegal activity in the U.S. financial sector.

As proposed, the rule would clarify and strengthen customer due diligence obligations of banks and other financial institutions, including brokers or dealers in securities, mutual funds, futures commission merchants, and introducing brokers in commodities. The proposed amendments would add a new requirement that these entities know and verify the identities of the real people who own, control, and profit from the companies they service.

So where are we now? The comment period on the CDD NPRM closed in October 2014. We received 126 comments, illustrating the high level of interest in the proposal. Commenters included trade associations, law firms, consulting firms, research institutes, banks, other financial institutions within the scope of the rule and otherwise substantially impacted, federal regulatory agencies, and several concerned individuals.

Some commenters requested greater clarification on questions of scope and key definitions, while  others proposed more significant revisions to the rule. Many commenters nonetheless expressed broad thematic support for the rulemaking’s underlying purposes. We are now in the process of thoughtfully reviewing, discussing, and considering the issues that were raised by those that  commented. This is why there is an NPRM process, so we can gather feedback and consider change. We want to get this right.”

***

Law Enforcement Awards.    FinCEN announced the presentation of its first-ever Law Enforcement Awards at a ceremony at the Treasury Department on May 12.  The program is intended to: 1) recognize law enforcement agencies usage of BSA data to obtain a successful prosecution; and 2) to provide concrete evidence of the value of the BSA data to the financial industry.  The program includes six award categories and summaries of the cases are provided in the announcement.

***

SAR Stats.  FinCEN has issued the SAR Stats quarterly update, which provides information on Suspicious Activity Reports (SARs) filed through March 31, 2015.  The updated statistics can be viewed here. Credit Unions filed 20, 345 of the 213,280 SARs filed during first quarter 2015.             

HSBC Not Moving Fast Enough on AML Compliance Corrections; April 2015 BSA Blast

Written by Shari R. Pogach, Regulatory Paralegal

In December 2012, a combined federal, local and international government action accused global British bank, HSBC, of laundering money for drug cartels and transferring funds for terrorist regimes.  HSBC avoided criminal prosecution by paying a record settlement totaling $1.9 billion in forfeitures and penalties, and agreeing to court-appointed monitoring while the bank cleaned up its act.  But according to federal prosecutors in a court filing on April 1, 2015, HSBC’s clean-up progress is too slow.  As part of a quarterly update on the bank’s progress after the 2012 deferred prosecution agreement, the court filing summarizes the independent monitor's findings.  After monitoring HSBC’s operations for more than a year,  the monitor states the bank's weaknesses involve HSBC’s corporate culture and compliance technology: 

            “Overall, the Monitor believes that HSBC Group has made progress in developing an effective AML and sanctions compliance program and is better protected from and positioned to detect financial crime than when it entered into the DPA in December 2012. Specifically, the Monitor found that HSBC Group has made progress in the areas of risk assessment, “Know Your Customer” information and customer due diligence processes, compliance monitoring and testing, transaction monitoring alert adjudication and suspicious activity reporting, distribution of information to management, responses to potential financial crime violations, and incentivizing AML and sanctions compliance through compensation adjustment. However, in certain instances, the Monitor believes that HSBC Group’s progress has been too slow. The Monitor does not believe this is the result of bad faith or lack of commitment by HSBC Group’s senior leadership, but does believe that HSBC Group can – and must – do more.”  

[…] 

            “While adopting strong written policies is a significant step, it is only part of the equation. At present, the Monitor believes HSBC Group has a substantial amount of work left to do to implement its written policies. In the Monitor’s view, two of the greatest impediments to HSBC Group’s implementation of a sustainable compliance program are its corporate culture and its compliance technology. A strong corporate culture is one where senior executives, mid-level managers, and employees across business lines accept and believe in the importance of rigorous AML and sanctions compliance controls. The Monitor recognizes that a true cultural transformation in an institution as large and geographically diverse as HSBC Group and in an industry as challenged as the financial services industry is a massive undertaking. In the last year, the Monitor has seen a number of positive shifts in HSBC Group’s internal emphasis on AML and sanctions compliance.” 

[…] 

            “While this acceptance of responsibility by senior executives and the resulting tone from the top is important, it is not sufficient for a cultural transformation. Notwithstanding the attitude of HSBC Group’s senior executives, the Monitor observed other indicators that some of HSBC Group’s historical cultural deficiencies continue to pervade its operations today. For example, during the United States country review, the Monitor found that senior managers of HSBC Bank USA’s Global Banking and Markets (“GBM”) business line inappropriately pushed back against adverse findings by the HSBC Global Internal Audit team and HSBC Bank USA’s Compliance Testing and Control (“CTAC”) team arising from separate reviews in early 2014 of GBM’s “Know Your Customer” practices.”  

[…]  

            “Aside from corporate culture, one of the other biggest impediments to HSBC Group’s development of a sustainable compliance program, in the Monitor’s view, is its compliance technology. The Monitor believes, despite progress in improving its compliance technology, this remains an area of material weakness in which a great deal of work remains to be done. Specifically, HSBC Group’s compliance technology systems continue to suffer from fragmentation and lack of connectivity. The lack of connectivity between systems prevents the Bank’s investigators from easily reviewing a customer’s banking history when evaluating potentially suspicious activity and inhibits the adequate collection and analysis of customer due diligence information. The Monitor believes HSBC Group’s future compliance technology plans are reasonably calculated to produce an effective compliance program – if the plans can be successfully executed. Execution of these plans will be difficult, expensive, and time consuming.”  

HSBC’s Swiss subsidiary was recently found to have helped thousands of clients launder criminal proceeds and evade taxes. The Department of Justice (DOJ) has hinted at its willingness to revoke settlement agreements with banks where more wrongdoing is found.  The head of DOJ’s criminal division, Leslie Caldwell, outlined policy concerning repeat offenders.  In a March speech Caldwell stated:  

“…we have often entered into deferred prosecution agreements or non-prosecution agreements – known as DPAs and NPAs – with the banks.  

DPAs and NPAs are useful enforcement tools in criminal cases.  Through those agreements, we can often accomplish as much as, and sometimes even more than, we could from a criminal conviction.”

[…]  

“Make no mistake: the Criminal Division will not hesitate to tear up a DPA or NPA and file criminal charges, where such action is appropriate and proportional to the breach. 

DPAs and NPAs are powerful tools.  They can’t be ignored once they’re signed, and they can’t be followed partially but not completely.  We will take action to ensure that banks are held accountable for DPA or NPA violations.  And where a bank that violates a DPA or NPA is a repeat offender with a history of misconduct, or where a violating bank fails to cooperate with an investigation or drags its feet, that bank will face criminal consequences for its breach of the agreement.”  

Time will tell how much patience DOJ has for HSBC.

***

BSA Blast.   The April 2015 quarterly issue of the BSA Blast is now available for NAFCU members (member login needed).   This edition reviews the elements of an effective compliance program according to the Department of Justice’s (DOJ’s) Criminal Division and highlights two recent enforcement actions.  The issue also includes a new BSA quiz with a focus on OFAC compliance.

Regulatory Compliance School Kicks Off; March 2015 NCUA Report; NCUA Tidbits

Written by Bernadette Clair, Senior Regulatory Compliance Counsel

Regulatory Compliance School Kicks Off. NAFCU’s Regulatory Compliance School begins today!  During this intensive week, attendees will obtain a solid understanding of the various regulations and laws affecting credit unions’ regulatory compliance responsibilities. Many of these brave souls will also be studying hard to obtain their NAFCU Certified Compliance Officer (NCCO) designation. Wish them luck!

As a reminder, NAFCU’s Compliance Team will be in and out of the office giving presentations, so our response times may be a little longer than normal.

***

March 2015 NCUA Report. NCUA recently released its March 2015 Report. Featured articles include:

Office of National Examinations and Supervision Report: Funnel Accounts: A Funny Name, but a Serious Concern

Chairman’s Corner: Volunteers: Inspire and Question Management

Office of Examination and Insurance Report: Loan Growth at a Nine-Year High

Board Perspectives: Charter Choice and the Law of Natural Selection; True Transparency and Real Regulatory Relief

Board Actions February 2015: NCUA Board Proposes $100 Million Threshold for Regulatory Relief; Share Insurance Fund Trends Positive, Taunton Charter Expansion Approved

Region I Report: A Quick Guide for New Supervisory Committee Members

Office of National Examinations and Supervision Report: Cyber Vulnerabilities and the Real Exposures

Funnel Accounts. Two articles caught my eye. First, an article on funnel accounts discusses the growth of funnel accounts, warning signs of funnel accounts, and BSA reporting requirements related to these types of money laundering schemes.  For additional background, my colleague Shari Pogach blogged about funnel accounts and trade-based money laundering here.

Quick Guide for New Supervisory Committee Members. The second article takes a look at some of the responsibilities of the supervisory committee beyond the audit and verification roles.  Topics covered include strengthening internal controls, reviewing management’s corrective actions, and the authority to call special meetings and remove officials.

***

NCUA Spoofing Scam Warning.  Last week, NCUA warned that scammers are “spoofing” an agency telephone number and sending texts to consumers in an attempt to obtain personal information. More details are available here. This follows on the heels of a warning about an online phishing scam using a logo and design similar to the agency’s own. For more details, see our March 25th blog post.  

***

NCUA Video Series for Credit Unions Seeking CDFI Certification. NCUA has released a five-part video series for credit unions interested in becoming certified as Community Development Financial Institutions.  The videos, less than 10 minutes each, are available on NCUA’s YouTube channel and cover topics such as the criteria for certification as well as the benefits.

***

NCUA Grant Initiatives Webinar. NCUA will be hosting a webinar entitled “NCUA 2015 Grant and Loan Opportunities” for credit unions interested in applying for the next round of grants from the agency. Topics to be discussed include the grant application process and the four grant initiatives that NCUA will fund: cybersecurity, building capacity branching, digital growth and new products and services. The presentation will be followed by a 30-minute question-and-answer session. The webinar is scheduled for Wednesday, April 15, beginning at 2 p.m. Eastern. Online registration is available here. Participants may submit questions in advance at [email protected]. The subject line of the email should read, “NCUA 2015 Grant and Loan Webinar.”

Regulators Issue FAQs for Youth Share Accounts; NAFCU Offers BSA/AML Examination Manual Webinar

Written by Eliott C. Ponte, Regulatory Compliance Counsel

The NCUA and other banking regulators recently issued interagency guidance to encourage financial institutions to develop and implement programs to expand youth savings programs.  While this guidance does not create any federal regulator policy or establish new industry expectations, it does provide answers to frequently asked questions related to the establishment of these programs.  In total, there are 10 frequently asked questions and a section that provides a host of other hyperlinked resources. Below are highlights from the interagency guidance:

Minors Savings Accounts

The guidance reaffirms that there is no federal law prohibiting minors from opening share accounts, and the issue of having such an account is governed by state contract law.  While some states have laws specific to minors opening share accounts, credit unions in states without these laws will need to rely on state contact law.  The guidance further states that minors generally do not have legal capacity to enter into a contract, which includes any account agreement with a credit union.  Thus, such an agreement with a minor may be “voidable.”  Whether it is legally permissible for a credit union to open an account for a minor without requiring a responsible adult to be the custodian or co-owner is a determination that a credit union should make in consultation with local counsel

Minors with a Custodial Account Receiving ATM or Debit Card

The guidance clarifies that each state's Uniform Transfers to Minors Act or Uniform Gifts to Minors Act govern the rules concerning the issuance of ATM and debit cards.  The guidance states that because a custodian manages the funds in an account on behalf of the minor, a minor with a custodial account should not be provided with an ATM or debit card that permits withdrawals.

Customer Identification Program (CIP)

The guidance provides answers to various CIP issues that arise when a minor or their custodian opens an account.  Specifically, the guidance states that when a minor opens a savings account without the involvement of a custodian (e.g., mother, guardian, etc.), the minor is considered the customer for CIP purposes.  However, when a custodian opens an account for the minor, the custodian is considered the customer.  The guidance reiterates requirements under CIP are the same as for an adult: the credit union must obtain a name, date of birth, address, and identification number. 

 

***

Risks & Revisions: Changes to the BSA/AML Examination Manual

Live Webcast: Wednesday, March 18  |  2:00 p.m. – 3:30 p.m. ET

Revisions to the FFIEC BSA/AML Examination Manual have been much-anticipated, but here’s what wasn’t: hidden operational hurdles.  In this strategic webcast, you’ll join popular credit union attorney and former BSA officer David Reed as he highlights the most significant changes to the manual, along with the compliance and operational implications.  From SAR reporting to Bulk Cash shipments, David will help you prepare your credit union to be compliant.  For more information on this webcast, click here.

Tax Filing Season Prime Time for Tax-Related Identity Theft; RBC Webcast

Written by Shari R. Pogach, Regulatory Paralegal

Tax time is open season for identity thieves.  The most common form of identity theft complaint reported to the Federal Trade Commission in 2014 was tax-related identity theft.  According to FTC statistics, the FTC received 2,545 complaints about Internal Revenue Service (IRS) about IRS imposter scams but the number of complaints jumped to 54,690 in 2014.  Of the 332,646 overall complaints about identity theft received by the FTC in 2014, 109,063 or 32.8 percent were about tax identity theft. 

Tax identity theft usually occurs when a scammer files a fraudulent tax return using a consumer’s Social Security number in order to get a refund.  In IRS impersonation scams, a person will generally contact a consumer by phone, claiming they are an IRS agent and the consumer owes the agency money.  The callers then suggest the consumers pay by wiring money or loading money on a pre-paid debit card.  The calls may seem to be from Washington, DC, numbers and such callers will often threaten arrest or legal action. In addition, the scammers may even know a consumer’s full or partial Social Security number.  Complaints related to IRS impersonation indicate this technique is being used across the country against consumers. 

Fake emails or websites are also used to “phish” for valuable personal information. Phishing scams are typically carried out with the use of unsolicited email or a fake website posing as a legitimate site to lure potential victims to give out personal and financial information.  This is then used to commit identity or financial theft.  The IRS continues to include phishing on its annual list of “Dirty Dozen” tax scams for the 2015 filing season.  

Such scams prey on consumers’ lack of knowledge about how the IRS contacts taxpayers.  Consumers should be aware that the IRS will never call about unpaid taxes or penalties.  The IRS also generally does not initiate contact with a taxpayer by email to request personal or financial information, including any type of electronic communication, such as text messages and social media channels. 

The National Credit Union Administration (NCUA) notes that identity theft is a large and growing problem with more than 16 million Americans victimized in 2012.  The IRS has estimated it paid more than $5 billion in fraudulent tax refunds in 2013.  

To help educate consumers, protect themselves and take action if they believe they have been victimized, the FTC, IRS and NCUA offer the following resources:

 IRS

Warning about Phone Scam

Report Phishing and Online Scams

YouTube Videos – Identity Theft

FTC

Identity Theft

Tax-Related Identity Theft

NCUA

mycreditunion.gov - Prevent Identity Theft

mycreditunion.gov - Frauds and Scams

NCUA YouTube Channel Frauds and Scams

***

NAFCU Webcast.  The Revised Risk-Based Capital Rule's Impact: A Closer Look, Wednesday, March 11, 2:00-3:30pm ET. The biggest modifications to the second proposed risk-based capital rule include the number of credit unions impacted, implementation period and proposed risk weights. Attend this comprehensive webcast to deep dive into exactly what these changes are and how they will affect your credit union.  You will learn how to calculate the  new proposed risk-based capital ratio, the level of prompt corrective action to which a credit union would be subject and more.

Bank Teller Part of Identity Theft Fraud Scheme; BSA Blast; Regulatory Compliance School

Written by Shari R. Pogach, Regulatory Paralegal

The Department of Justice, along with the U.S.Attorney’s Office for the Middle District of Alabama and the Internal Revenue Service (IRS) announced the resolution of a more than $700,000 stolen identity tax refund fraud scheme. 

Tarrish Tellis, 38, of Montgomery, Alabama, and his co-conspirator, Nakia Jackson, obtained approximately 700 names, dates of birth and social security numbers from an employee of the Alabama Medicaid State Agency to file false tax returns.  Then to hide his involvement and conceal where the funds originated, Tellis recruited several friends and relatives to open up bank accounts for the purpose of receiving fraudulent tax refunds.  When a tax refund was deposited into their bank accounts, Tellis then had them withdraw the money and provide it to him. More than $300,000 flowed through these accounts.

Tellis also recruited a bank teller, Laquanta Clayton, who used her position to open up bank accounts in the name of fictitious individuals and in the name of her daughter’s father.  Around $200,000 went into the accounts that Clayton controlled.  Clayton then withdrew the money and gave the majority of the money to Tellis. 

Tellis faces a statutory minimum sentence of two years in prison and a statutory maximum sentence of 125 years in prison, plus fines and forfeiture. Jackson was sentenced to serve 87 months in prison and Clayton was sentenced to serve 21 months in prison.

***

BSA Blast - The January 2015 quarterly issue of the BSA Blast is now available (NAFCU login required). The main focus of this edition is FinCEN’s case against a former chief compliance officer for BSA violations but we also review NCUA’s MSB guidance.  In addition there is a new BSA quiz that focuses on the updated suspicious activity reporting section of the BSA/AML Examination Manual.

***

NAFCU’s Regulatory Compliance School – Enroll and reserve your seat today! You still have time to save $100 with promo code SCHOOLSAVINGS. But do hurry as this offer ends January 23, 2015.

NCUA Supervisory Focus for 2015; Consumer Compliance Outlook; Last Day for Holiday Savings

Written by Bernadette Clair, Senior Regulatory Compliance Counsel

NCUA Supervisory Focus for 2015. NCUA recently released Letter to Credit Unions 15-CU-01, detailing the agency’s supervisory priorities for 2015. Areas of focus include cybersecurity, interest rate risk, Bank Secrecy Act compliance, and compliance with new regulations – NCUA’s liquidity rule, the CFPB’s Ability-to-Repay and Qualified Mortgage rule, and the CFPB’s TILA/RESPA Integrated Disclosure rule (after the rule goes into effect on August 1, 2015), are specifically mentioned.

In the area of cybersecurity, the focus is on proactive measures to protect data and members, as well as the ability to respond in the event of a breach. From the letter:

“NCUA field staff will focus on proactive measures credit unions can take to protect their data and their members, including:

• encrypting sensitive data;
• developing a comprehensive information security policy;
• performing due diligence over third parties that handle credit union data;
• monitoring cybersecurity risk exposure;
• monitoring transactions, and
• testing security measures.

Field staff will also be evaluating credit unions’ capacity to recover and resume operations in the event a security breach does occur. Appendix B to NCUA Rules and Regulations Part 748 provides guidance on developing an incident response program that can help a credit union react to a breach. These programs can help the credit union assess the nature and scope of an incident, determine when to contact law enforcement and notify members, and take steps to safely resume operations.

Credit union officials are also encouraged to review the online cybersecurity resources posted by NCUA and the FFIEC’s Cybersecurity and Critical Infrastructure Working Group to promote cybersecurity throughout the financial services industry.”

In the letter, NCUA also indicates that it is continuing to monitor trends in credit unions’ loan portfolios, and that it is streamlining exams for credit unions with assets up to $50 million and CAMEL ratings of 1, 2, or 3. For complete details, the letter is available in its entirety here.

***

Consumer Compliance Outlook. The Fourth Quarter 2014 issue of the Federal Reserve’s Consumer Compliance Outlook is now available.  One of the articles, entitled “Managing Compliance Risk Through Consumer Compliance Risk Assessments,” discusses the use of consumer compliance risk assessments in identifying, measuring, monitoring, and managing consumer compliance risks associated with products and services.  Although geared towards institutions subject to the Federal Reserve Board’s Community Bank Risk-Focused Consumer Compliance Supervision Program, the article is a good read.

***

Final day: Save $200 on any NAFCU Conference! Save $200 when you use code HOLIDAY on any of NAFCU’s 2015 conferences. It’s a great way to save big on NAFCU training; you can use code HOLIDAY as many times, and with as many employees, as you like! Our conferences are jam-packed with ideas designed to help you eliminate compliance headaches. View our conferences now and register using code HOLIDAY today; it’s your last day to save $200!

NCUA Issues Money Services Business Supervisory Letter

Written by Eliott C. Ponte, Regulatory Compliance Counsel

Last month, the NCUA issued a supervisory letter regarding money services businesses (MSBs).  The supervisory letter does three things:  First, the supervisory letter gives background information on MSBs, explains how MSBs pose risk on credit unions, and lists expectations for credit unions.  Second, the supervisory letter details exam procedures.  Credit unions working with MSBs will want to review this section of the supervisory letter before an examination.  Last, the NCUA lists additional guidance documents relevant to MSBs, including supervisory guidance issued by the Federal Financial Institutions Examination Council.  While I believe this supervisory letter is extremely important and insightful to credit unions, I will not be analyzing the entire letter in this blog post.  I can’t, there is too much information. Instead, I will only cover the first part of the supervisory letter as it relates to its guidance on determining the risk associated with MSBs. 

Before talking about risk, it is helpful to discuss the definition of a MSB.  MSBs are transactional businesses that include check cashers, prepaid card providers, foreign currency dealers, money transmitters, and money orders and travelers checks issuers.  See 31 CFR 1010.100(ff).  While the NCUA acknowledges that MSBs provide valuable services to consumers, the cash-intensive nature of MSBs pose elevated risk for potential money laundering activities.  Thus, where elevated risk activity is present, credit unions must “exercise heightened due diligence by establishing monitoring and controls to properly assess, minimize, and manage the risk of money laundering.”

All types of financial institutions have struggled with determining the type of risk associated with MSBs.  In recent months, some financial regulators have pressured financial institutions to cut ties with these legally-run business to reduce risk and operational costs (see operation choke point and this blog post).  One major issue with MSBs is that not all MSBs pose the same level of risk.  For instance, the amount risk associated with each MSB will depend on its size, the primary nature of the business (i.e., a grocery store that offers check cashing will have less risk when compared to a standalone check cashing business), its recordkeeping practices, the frequency of cash transactions, identification requirements, customer base, and other factors.  Thus, each MSB will require a different level of due diligence based on the credit union’s review and assessment.

What makes the NCUA’s supervisory letter so important is that it lists several types of factors that credit unions should consider when working with MSBs.   Below are some examples of factors the NCUA believes credit unions should consider when assessing risk in MSBs:

Examples of potentially higher risk indicators:

• The MSB allows customers to conduct higher-amount transactions with moderate to high frequency;
• The MSB offers multiple types of money services products;
• The MSB is a check casher that cashes any third-party check or cashes checks for commercial businesses;
• The MSB is a money transmitter that offers only, or specializes in, cross-border transactions, particularly to jurisdictions posing heightened risk for money laundering or the financing of terrorism or to countries identified as having weak anti-money laundering controls;
• The MSB is a currency dealer or exchanger for currencies of jurisdictions posing heightened risk for money laundering or the financing of terrorism or countries identified as having weak anti-money laundering controls;
• The MSB is a new business without an established operating history; or
• The MSB is located in an area designated as a High Intensity Financial Crime Area  or a High-Intensity Drug Trafficking Area.

Examples of potentially lower risk indicators:

• The MSB primarily conducts routine transactions with moderate frequency in low amounts;
• The MSB offers only a single line of money services business product (for example, only check cashing);
• The MSB is a check casher that does not accept out-of-state checks;
• The MSB is a check casher that does not accept third-party checks or only cashes payroll or government checks;
• The MSB is an established business with an operating history;
• The MSB only provides services such as check cashing to local residents;
• The MSB is a money transmitter that only remits funds to domestic entities; or
• The MSB only facilitates domestic bill payments.

The supervisory letter also lists risk mitigation factors:

• Proper identification of MSB relationships
• Adequate assessment of potential risks
• Adequate understanding of the business model and activity of the MSB
• Adequate and ongoing due diligence relative to the risk assessed
• Adequate and ongoing suspicious activity monitoring
• Adequate staffing, expertise, and resources

Credit unions working with MSBs, or considering working with MSBs, should review the supervisory letter in its entirety.  While the supervisory letter stresses the importance of due diligence, credit unions should also remember that the NCUA has repeatedly stated that “the BSA does not require credit unions to serve as a regulatorof any type of MSB account.” 

Holiday News from the NCUA; Programming Note; Speaking of Holidays

Written by JiJi Bahhur, Director of Regulatory Compliance

With 2014 coming to an end, I thought I'd put on your radar some of the more recent items released by the National Credit Union Administration (NCUA) during this very busy holiday season.

MSB Exam Guidance from the NCUA.  For sake of not bogging you down on New Year’s Eve, I won’t be covering this guidance in any detail here (but we’ll be sure to do so in a very near future blog post).  What I do want to do is put it on your radar in case you missed it during the busy holiday season.

Just briefly, what is this guidance?  NCUA released Letter to Credit Unions 14-CU-10 (“letter”) to provide guidance to credit unions that provide or intend to provide account services to a money service business (MSB).  In the letter, it discusses what an MSB is, the potential risks posed by MSBs, and how a credit union can mitigate those risks.  Moreover, the letter advises credit unions to review the enclosed examiner guidance – Supervisory Letter No. 14-05 – because NCUA’s field staff have been provided this examiner guidance and will use it to evaluate credit unions that provide account services to MSBs.   

First 2015 Grant Round for Low-Income CUs.  With an application period between February 2 and March 3, 2015, NCUA is inviting applications for low-income credit unions interested in providing staff training or hiring interns through use of funds from the Community Development Revolving Loan Fund.  NCUA has stated that it will provide at least $360,000 in funding during this first grant round in 2015, which will cover more than 100 requests from low-income credit unions for internships or staff or volunteer training programs.  If you are designated as a low-income credit union, check out the NCUA’s announcement here for more information and how to apply.  

Latest Videos from the NCUA.  In the last couple of weeks, the NCUA has made available the following videos:

• NCUA Assessment Update - Stabilization Fund –posted on December 16^th, the video is based on information presented at the July 2014 NCUA open Board meeting. 
• New Economic Update Video – posted on December 23^rd, this video covers the latest economic activity, the 2015 economic outlook and the performance of federally insured credit unions during the third quarter.
• New NCUA Video Outlining Field of Membership Options and Strategies – posted on December 29^th, the video provides an overview of the various field of membership types available to federal credit unions and briefly identifies expansion and conversion opportunities available for each field of membership type.

***

Programming Note.  NAFCU’s offices will close today at noon for the New Year and will reopen on Monday, January 5.  Happy New Year to you all! We’ll be back to blogging on Monday.

***

Speaking of the holidays – my two-year old twins, Kyse and Ava, had a blast opening presents and going from house to house visiting family.  Some photos from the festivities:

Happy New Year to you all! 

The 2014 Version of the Bank Secrecy Act/Anti-Money Laundering Examination Manual

By Eliott C. Ponte, Regulatory Compliance Counsel

On Wednesday, the Federal Financial Institutions Examination Council (FFIEC) released a revised Bank Secrecy Act/Anti-Money Laundering Examination Manual (BSA/AML Manual).  Revisions were made throughout the BSA/AML Manual.  The sections with more significant revisions were noted in the BSA/AML Manual table of contents with “2014” in the subsection’s title.  In addition, the revised BSA/AML Manual has two new sections:  Prepaid Access, which replaces E-Cash; and, BSA E-Filing System. 

Significant updates include:

“Suspicious Activity Reporting (SAR) – Incorporated new SAR E-Filing requirements; guidance on the extension of SAR filing for continuing activity; clarification of prohibitions on disclosing a SAR; and guidance on sharing SARs with affiliates.

Currency Transaction Reporting (CTR) – Revised to incorporate new CTR E-Filing requirements and new guidance issued by FinCEN since 2010 related to currency transaction aggregation for businesses and exemptions.

Foreign Correspondent Account Recordkeeping – Included regulations relating to the Comprehensive Iran Sanctions, Accountability, and Divestment Act.

Foreign Bank and Financial Accounts (FBAR) – Incorporated new FBAR filing requirements.

International Transportation of Currency or Monetary Instruments Reporting (CMIR) – Clarified monitoring and reporting obligations under the BSA for international transportation of currency or monetary instruments.

Correspondent Accounts (Foreign) – Included additional guidance in the section on risk mitigation.

Bulk Shipments of Currency – Revised to incorporate FinCEN’s CMIR guidance for common carriers of currency, including armored car services (August 1, 2014), and clarify monitoring and reporting obligations under the BSA.

Automated Clearing House Transactions (ACH) – Incorporated National Automated Clearing House Association (NACHA)-The Electronic Payments Association modifications related to international ACH transactions and further defined third-party service providers.

Prepaid Access – Replaced Electronic Cash section and included an expanded discussion of risk factors and risk mitigation related to prepaid access.

Third-Party Payment Processors – Updated to reflect interagency guidance issued since 2010.

Embassy, Foreign Consulate, and Foreign Mission Accounts – Updated to incorporate the interagency guidance on accepting accounts from foreign embassies, consulates, and missions.

Nonbank Financial Institutions – Incorporated new FinCEN regulations for Money Services Businesses (MSBs) related to certain foreign-located persons engaging in MSB activities; new regulations related to prepaid access programs; and guidance regarding virtual currency administrators and exchangers.

Appendix T: BSA E-Filing System – Created to provide examiners with information on the FinCEN BSA E-Filing System.” 

Interagency Statement (Dec. 2, 2014).

The 2014 version of the BSA/AML Manual is available on FFIEC’s website in PDF format.  The non-PDF version of the Manual has not been published to FFIEC’s website as of the date of this blog post.  FFIEC has not stated it plans to remove the online version of the BSA/AML Manual from its website, thus NAFCU expects FFIEC’s website to be updated shortly. 

***

 Programming Note: NAFCU's offices will close at 1:30 today for our annual holiday party.  We will be back to our desks on Monday. Have a great weekend!

FinCEN on Providing Financial Services to Money Services Businesses

Written by Shari R. Pogach, Regulatory Paralegal

The Financial Crimes Enforcement Network (FinCEN) has released not guidance, not an advisory but…….a “statement’ on offering banking services to Money Services Businesses (MSBs). The agency issued the document, FinCEN Statement on Providing Banking Services to Money Services Businesses, to reiterate FinCEN’s expectations for financial institutions’ obligations under the Bank Secrecy Act (BSA) for MSBs. 

FinCEN is concerned that MSBs, an important part of the financial system, are losing access to banking services possibly because of increased regulatory scrutiny, the perceived risks presented by MSB accounts, and the costs and burdens associated with maintaining such accounts.  Apparently MSB accounts are being indiscriminately terminated or not being opened as an entire category rather than being risk assessed on a case-by-case basis.  However, as MSBs provide financial services to people less likely to use traditional banking services and because MSBs play a prominent role in providing global remittance services, FinCEN wants to remind financial institutions that the industry can be served while still meeting BSA obligations. FinCEN’s concern is, “Refusing financial services to an entire segment of the industry can lead to an overall reduction in financial sector transparency that is critical to making the sector resistant to the efforts of illicit actors.  This is particularly important with MSB remittance operations.” FinCEN, the Internal Revenue Service and state regulators have all taken steps to increase and strengthen the effectiveness of oversight of MSB BSA compliance with supervision, guidance and examination materials.  

The agency does not support the wholesale termination of MSB accounts without regard to the risks presented or the financial institution’s ability to manage the risk as MSBs present varying degrees of risk and not all are high-risk.  FinCEN does not expect financial institutions to serve as a regulator of the MSB industry and recognizes it is not possible for an institution to detect and report all potentially illicit transactions that may flow through an institution. FinCEN does expect financial institutions that open and maintain accounts for MSBs to:

• Apply the requirements of the BSA, as with all accountholders, based on risk;
• Have appropriately designed policies and procedures to assess an MSB’s money laundering and terrorist financing risk; and
• Treat each MSB on a case-by-case basis, as with any accountholder.

Financial institution’s that can properly manage relationships and effectively mitigate risks are neither discouraged nor prohibited from providing services to MSBs, regardless of its specific business model.

This and That on the BSA and Virtual Currency

Written by Shari R. Pogach, Regulatory Paralegal 

The Financial Crimes Enforcement Network (FinCEN) recently released two administrative rulings, FIN-2014-R011 and FIN-2014-R012 on virtual currency transactions.  FinCEN’s rulings find that all virtual currency payment systems and trading platforms are money transmitters so must comply with Bank Secrecy Act (BSA) rules and regulations.  As money transmitters or money services businesses, companies providing virtual currency payment systems and trading platforms are required to “comply with all risk management, risk mitigation, recordkeeping, reporting and transaction monitoring requirements corresponding to such status.”

***

The U.S. Immigration and Customs Enforcement’s (ICE) Office of Public Affairs announced that ICE, Homeland Security Investigations (HSI) and the FBI have arrested the operator and owner of a black market Silk Road 2.0 website designed to buy and sell illegal drugs and other unlawful goods over the Internet.  Since about December 2013, Blake Benthall, 26, aka “Defcon” has operated the underground website used to distribute hundreds of kilograms of illegal drugs and other illicit goods and services to buyers throughout the world, as well as to launder millions of dollars generated by these unlawful transactions. As of September 2014, Silk Road 2.0 was generating sales of at least approximately $8 million per month.

Silk Road 2.0 was created approximately five weeks after the government’s October 2013 seizure of the website known as “Silk Road” and the arrest of its alleged owner and operator, Ross William Ulbricht aka “Dread Pirate Roberts.”  Silk Road 2.0 was virtually identical to the original Silk Road website in the way it appeared and functioned. Like its predecessor, Silk Road 2.0 operated exclusively on the Tor network and required all transactions to be paid for in bitcoins in order to preserve its users’ anonymity and evade detection by law enforcement. 

***

Have you heard about the new digital currency, Murraycoin, which borrows the face of comedian and actor, Bill Murray?  Launched in January, the Murraycoin website states that Murraycoin is a decentralized peer-to-peer currency enabling worldwide instant payments and is six times faster than Bitcoin.   The intent is to raise money for charity, educate the population on the use and advantages of cryptocurrency, and to have fun. It was thought using his likeness would raise awareness of digital currency since most people know of Bill Murray and like him. Although Mr. Murray has not specifically objected to the use of his name or likeness, he also has not endorsed the digital currency.   Although Bitcoin’s price has dipped to below $350, it’s still worth more than one Murraycoin, one is worth less than five cents.

***

According to multiple news sources, U.S. prosecutors have opened a money laundering investigation into a member of Russian President Vladimir Putin’s inner circle. The U.S. Attorney’s Office for the Eastern District of New York is probing whether billionaire Russian gas trader Gennady Timchenko transferred funds related to allegedly corrupt deals in Russia through the U.S. financial system.  Timchenko was among the first Russians to face sanctions imposed following Russia's annexation of Crimea from Ukraine in March and later over Moscow's wider role in the crisis in Ukraine. Prosecutors are probing transactions in which the Geneva-based commodities firm Timchenko co-founded, Gunvor Group, purchased oil from Russia’s OAO Rosneft and later sold it to third parties.  Although the transactions predate the financial sanctions, transfers of funds related to the transactions could constitute illegal money laundering if the funds were found to have originated from illicit activity such as, for example, irregular sales of state assets like oil.

Obstructing the Finances of Transnational Organized Crime Across the U.S./Mexico Border and the October BSA Blast and BSA Quiz

Written by Shari R. Pogach, Regulatory Paralegal

During a recent speech, Jennifer Shasky Calvery, director of the Financial Crimes Enforcement Network (FinCEN), discussed the agency’s work in conjunction with government entities in Mexico to safeguard each country’s financial systems from criminal financial abuse. Shasky Calvery stated that Mexico and the United States share more than a border, they work together on multiple fronts “to disrupt the finances of transnational organized crime, including those organizations engaged in drug trafficking, human trafficking and smuggling.” The FinCEN director also noted that what happens in Mexico impacts the United States so it’s important that the authorities in both countries “understand what financial institutions on both sides of the border are experiencing.”

In September, Mexico’s president announced the Mexican government will no longer limit the monthly cash deposits of U.S. dollars that corporate clients of border banks can make provided such clients meet certain requirements.  The movement of currency across the U.S. border to Mexico continues to be an issue and this recent action by the Mexican government has elevated money laundering concerns.

NAFCU members can read more on FinCEN’s recent actions to combat criminal financial abuse in the October issue of the BSA Blast.  The issue reviews FinCEN’s guidance on financial activity that could signal red flags for human smuggling and human trafficking as well as the agency’s focus on money laundering activity across the U.S. border to Mexico and other Latin American countries.  The October edition also includes a BSA quiz that focuses on red flags for financial activity in connection with human smuggling and trafficking.  The quiz can be used in training for frontline personnel.

FBI Financial Crime Cases Illustrate BSA Abuses; Two Programming Notes

Written by Shari R. Pogach, Regulatory Paralegal

I’ve previously written that real world examples of criminal activity can be useful training tools for Bank Secrecy Act education.  Real world examples can be used to get your staff thinking about what to look for when interacting with members on the front line.  Under the news section of the Federal Bureau of Investigation’s (FBI’s) website one can find a treasure trove of cases involving financial crimes.  Here are snippets from example cases: 

Embezzlement and Elder Financial Abuse:

Bank Employee Sentenced for Embezzling from Senior Citizens’ Accounts

“Diane Elizabeth Niehaus, 40, of Sugarcreek Township, Ohio, was sentenced in U.S. District Court to serve 60 months in prison, followed by three years of supervised release, for embezzling from the accounts of elderly customers of the bank where she worked as a manager. She was also ordered to pay restitution to the victims of her embezzlement and to the IRS.”

Automated Clearing House (ACH) Fraud:

Kansas City Woman Indicted in $3 Million Fraud Scheme That Forced Employer into Bankruptcy

[…]

“According to the federal indictment, for approximately 10 years (January 2004 until February 2014) Brooner created unauthorized Automated Clearing House (ACH) transactions from Galvmet’s bank account. An ACH is a batch-oriented funds transfer system that includes direct deposits of payroll from companies. Brooner allegedly deposited these funds into her personal bank accounts. Brooner also manipulated ACH transactions to inflate her salary, the indictment says, by increasing her bi-weekly payments without the knowledge or authorization of her employer. She allegedly deposited these funds into her bank accounts.

As a result of Brooner’s fraud scheme, the indictment says, Galvmet lost at least $1,863,914. As a result, Galvmet declared bankruptcy, and was forced to cease operations. To keep the scheme going, Brooner allegedly falsified documents to support Galvmet’s operating loan with Missouri Bank & Trust, causing a loss to the bank of $1.1 million. Brooner allegedly converted the embezzled funds for her personal enrichment. The total loss from Brooner’s alleged fraud scheme was at least $2,963,914.”

Trade-Based Money Laundering Activity: 

Money Laundering Takedown - Operation Targets Sinaloa Drug Cartel

“In a major takedown in Los Angeles on Wednesday, September 10, nearly 1,000 federal, state, and local law enforcement officers seized approximately $100 million in cash, arrested nine subjects, and searched dozen of businesses in the city’s downtown fashion district alleged to have laundered money for Mexican drug cartels.”

You might want to use cases from this website as yet another resource to help with ongoing BSA education and training.

***

Programming Note #1.  NAFCU’s offices will close at noon today for the Columbus Day Holiday and will reopen on Tuesday, October 14.  We will be back to blogging on Wednesday, October 15.

***

Programming Note #2.  It’s seminar time at NAFCU! The Regulatory Compliance team will be at NAFCU’s 2014 Regulatory Compliance Seminar in Baltimore, MD. Your compliance questions will be answered but we appreciate your patience as the team will be in and out of the office this week.

FinCEN’S Technical SARs Data Bulletin Also Offers Form Guidance; TILA/RESPA Webcast

Written by Shari R. Pogach, Regulatory Paralegal

Have you had a chance to take a look at the Financial Crimes Enforcement Network’s (FinCEN’s) new publication called SAR Stats?  The successor publication to The SAR Activity Review: By the Numbers, FinCEN released the first issue of this technical bulletin in July.  

FinCEN’s SAR Stats gives suspicious activity report (SAR) data for depository institutions and other industries for SARs filed between March 1, 2012 and December 31, 2013, inclusive.  SAR Stats provides statistical analyses by geography and activity type.   In addition to the technical data, there are new sections that dive deeper into how the data is being analyzed more effectively to identify new and emerging patterns, as well as compare trends across industries.

This first issue also includes a section on best practices for completing the (z)Other field on the electronic FinCEN SAR form.  Also included are illustrations of free-text entries that did not meet FinCEN’s guidance to describe the type of suspicious activity in the (z)Other field:

1. “Many (thousands) of entries lacked critical specifics by omitting the type of product or instrument used in the suspicious activity. For example, there were thousands of entries containing only the single term Kiting. This one-word subject needed vital specific descriptors that would have made it useful (e.g., Check Kiting). Specific descriptors will reveal activity trends more clearly and are more useful to law enf orcement tracking the extent of the products/instruments frequently associated with the activity, in this case, checks and credit cards.
2. Undefined entries that do nothing to describe the suspicious activity, including Excessive or Excessive Activity, Unusual or Unusual Activity, and Suspicious or Suspicious Activity, should not be used. 
3. Use of broad all-inclusive themes also should not be used as they do nothing to further put the entry into perspective: e.g., BSA/Structuring/Money Laundering or, simply, BSA, Structuring, or Money Laundering.
4. Prohibited words and phrase: None, Not Applicable, Other, Same, Same as Above, See Above, See Narrative, Unknown and XX, should not be used. Such entries are of no value.
5. Entries using dollar amounts, dates, or series of numbers are of no value. 
6. Free text entries should not be in quotes. Quotation marks comprise a difficulty in synthesizing entries. The (z)Other boxes should not be checked when the associated text field is left blank. 
7. Filers should avoid using the (z)Other field when an option already exists for that violation. For example, filers entered Elder Financial Exploitation16 in the zOther field within the Fraud category instead of checking box 35(d) (Elder Financial Exploitation) within the Other Suspicious Activities category. 
8. Text should not merely repeat the category without providing any specifics: Category: Terrorist Financing, (z)Other text entry: Terrorist Financing or Category: Fraud, zOther text entry: Fraud. The text entry in (z)Other is intended to provide more information to streamline searching.”

FinCEN reminds filers that if care isn’t used to complete the form, incorrect entries will lead to inaccurate reporting that is of no use to anyone.

***

NAFCU Webcast - Prepare now for the changes in your credit union’s policies, procedures and general practices for the implementation of the Truth in Lending (TILA) and Real Estate Settlement Act (RESPA) Integrated Disclosure Rule on August 1, 2015, with this webcast Wednesday, October 1 from 2:00–3:30pm ET.  The early bird registration deadline for TILA/RESPA: Difficult Issues and Their Solution is September 24.

FinCEN Advisory on Human Smuggling and Human Trafficking Financial Red Flags; Increased Regulations Z and M Threshold Levels for 2015

Written by Bernadette Clair, Senior Regulatory Compliance Counsel

FinCEN Advisory on Human Smuggling and Human Trafficking Financial Red Flags. FinCEN has issued Advisory FIN-2014-A008 to provide guidance to financial institutions on how to detect and report suspicious activity that may be related to human smuggling and/or human trafficking.  The guidance includes financial “red flags” that may indicate financial activity related to human smuggling or human trafficking in Appendices A and B, and also provides key terms that financial institutions can use when reporting this type of suspicious activity.  FinCEN request that financial include the key term(s) “ADVISORY HUMAN SMUGGLING” and/or “ADVISORY HUMAN TRAFFICKING” in the Narrative and the Suspicious Activity Information, to the extent they are able to distinguish between the two.

Here’s an excerpt from FinCEN’s guidance to financial institutions, starting on page 4:

“Due to some similarities with legitimate financial activities, financial institutions may consider evaluating indicators of potential human smuggling or trafficking activity in combination with other red flags and factors, such as expected transaction activity, before making determinations of suspiciousness. No one transaction or red flag by itself is a clear indicator of human smuggling or trafficking. Additionally, in making a determination of suspiciousness, financial institutions are encouraged to use previous FinCEN advisories and guidance as a reference when evaluating potential suspicious activity. For instance, in May 2014 FinCEN published an advisory on the use and structure of funnel accounts,⁴ one of the red flags identified in Appendices Aand B of this advisory. Financial institutions may consider incorporating the guidance outlined in this advisory in a manner that is commensurate with their risk profile and business model.

 

In evaluating whether certain transactions are suspicious and/or related to human smuggling or trafficking, financial institutions are encouraged to share information with one another, as appropriate, under Section 314(b) of the USA P ATRIOT Act.⁵ Section 314(b) establishes a voluntary information sharing mechanism allowing financial institutions to share information with one another regarding possible terrorist activity or money laundering and provides financial institutions with the benefit of a safe harbor from liability that might not otherwise exist with respect to the sharing of such information. ⁶ Thus, suspected money laundering involving the proceeds of human smuggling or human trafficking activity could be shared amongst financial institutions under Section 314(b).” (Footnotes omitted)

 

***

Increased Regulations Z and M Threshold Levels for 2015. Last week, the Fed and CFPB announced final rules implementing increased Regulation Z and Regulation M dollar thresholds for exempt consumer credit and lease transactions. Effective January 1, 2015, the dollar threshold for both regulations will be $54,600 (an increase of $1,100). These thresholds are adjusted annually to reflect increases in the Consumer Price Index for Urban Wage Earners and Clerical Workers, as applicable.

FinCEN on Promoting a Culture of Compliance; NAFCU Member Call-In

Written by Shari R. Pogach, Regulatory Paralegal

I recently attended the 2014 Mid-Atlantic Anti-Money Laundering Conference held here in Washington, DC, and heard Financial Crimes Enforcement Network (FinCEN) Director Jennifer Shasky Calvery speak on the fundamental importance of a culture of compliance to strengthen any Bank Secrecy Act/Anti-Money Laundering (BSA/AML) program.  One of the things Shasky Calvery noted was that it is not always easy to convey the need for a strong culture of BSA/AML compliance to a financial institution’s board of directors, leadership or senior management.  To assist with this, FinCEN has issued an advisory, FIN-2014-A007.  FinCEN’s advisory explains how a financial institution and its leadership can improve and strengthen organizational compliance with BSA obligations by ensuring that:

1. Leadership is actively supporting, understanding and engaged with compliance efforts;
2. Any efforts to manage and mitigate BSA/AML deficiencies and risks are not compromised by an institution’s interest in revenue;
3. Any relevant information throughout the organization is shared with compliance staff to advance BSA/AML efforts;
4. Leadership provides adequate human and technological resources;
5. The compliance program is effective and tested by an independent and competent party; and
6. The organization’s leadership and staff understand the purpose of its BSA/AML efforts and how the reports are used. 

FinCEN’s advisory is intended to be another tool to be used to influence an organization’s leadership, “to make it easier for them to live and breathe BSA/AML the same way that you do…….Because once you have a strong culture in place, including the support of your institution’s leadership, you have a firm foundation on which to build an effective program.” 

*** 

A Credit Union Industry Update – You shouldn't miss NAFCU’s member call-in on Tuesday, September 23, 2014, from 4:00-5:00 pm ET, as NAFCU President and CEO Dan Berger and other NAFCU senior staff will brief member credit unions on the latest legislative, regulatory, compliance and economic issues affecting credit unions.  Participation is free for all NAFCU members, but you must register to attend.

FinCEN's Proposed Rule on Customer Due Diligence

Written by Bernadette Clair, Senior Regulatory Compliance Counsel

FinCEN recently issued a proposed rule that would amend its existing rules to include explicit customer due diligence (CDD) requirements, including a requirement to identify beneficial owners of legal entity customers. This proposal has been in the works for some time – back in March 2012 FinCEN issued an advance notice of proposed rulemaking (ANPR) and held roundtable discussions seeking input from interested parties. For additional background information, see our previous blogs on this topic here, here, and here.

The proposed rule is intended to clarify and strengthen CDD within the Bank Secrecy Act (BSA) regime, with an aim towards enhancing financial transparency and safeguarding the financial system from illicit use by making sure “financial institutions perform effective CDD so that they know their customers – both who they are and what transactions they conduct.”

In the preamble to the proposed rule, FinCEN discusses what it believes are the minimum key elements of CDD. These include:

“(i) Identifying and verifying the identity of customers;

(ii) identifying and verifying the identity of beneficial owners of legal entity customers (i.e., the natural persons who own or control legal entities);

(iii) understanding the nature and purpose of customer relationships; and

(iv) conducting ongoing monitoring to maintain and update customer information and to identify and report suspicious transactions.”

FinCEN notes that the requirement to identify and verify the identity of customers (the first element above) is already included in the existing regulatory requirement to have a customer identification program (CIP). As a result, the proposed rule adds explicit requirements addressing the remaining three elements.

Under proposed section 1010.230, financial institutions would have to identify and verify the identity of the natural persons who are beneficial owners, as defined in the rule, for their legal entity customers, with some exceptions.  The proposal contains a Certification of Beneficial Owner(s) form in Appendix A that would be used for this purpose.  

Another highlight that caught my eye is that FinCEN is proposing to add an explicit reference to CDD requirements for understanding the nature and purpose of customer relationships and conducting ongoing monitoring in proposed changes to section 1020.210, which as amended would read:

Ҥ 1020.210 Anti-money laundering program requirements for financial institutions regulated only by a Federal functional regulator, including banks, savings associations, and credit unions.

A financial institution regulated by a Federal functional regulator that is not subject to the regulations of a self-regulatory organization shall be deemed to satisfy the requirements of 31 U.S.C. 5318(h)(1) if the financial institution implements and maintains an anti-money laundering program that:

(a) Complies with the requirements of §§ 1010.610 and 1010.620 of this chapter;

(b) Includes, at a minimum:

(1) A system of internal controls to assure ongoing compliance;

(2) Independent testing for compliance to be conducted by bank personnel or by an outside party;

(3) Designation of an individual or individuals responsible for coordinating and monitoring day-to-day compliance;

(4) Training for appropriate personnel; and

(5) Appropriate risk-based procedures for conducting ongoing customer due diligence, to include, but not be limited to:

(i) Understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile; and

(ii) Conducting ongoing monitoring to maintain and update customer information and to identify and report suspicious transactions; and

(c) Complies with the regulation of its Federal functional regulator governing such programs.”

(My emphasis.)

FinCEN indicates that this explicit reference to CDD requirements is not intended to change existing practices but rather to clarify existing practices.  However, this is one area that generated a lot of comments when the ANPR was issued because of concerns that this might necessitate asking targeted questions at account opening for every new customer about the nature and purpose of the account.

FinCEN discusses some of these concerns in the preamble, stating in part that it “believes that in some circumstances an understanding of the nature and purpose of a customer relationship can also be developed by inherent or self-evident information about the product or customer type, or basic information about the customer. FinCEN recognizes that inherent information about a customer relationship, such as the type of customer, the type of account opened, or the service or product offered, may be sufficient to understand the nature and purpose of the relationship. Obtaining basic information about the customer, such as annual income, net worth, domicile, or principal occupation or business, may similarly be relevant depending on the facts and circumstances.”

These are just a couple of highlights from the proposed rule – for complete details, it may be found in its entirety here. Comments on the proposal are due to the agency on or before October 3, 2014.  NAFCU’s Regulatory Affairs team is preparing a Regulatory Alert for NAFCU members, which will be available here.

Foreign Banks Pay Hefty Price for Violating U.S. Economic Sanctions; July BSA Blast and New BSA Quiz

Written by Shari R. Pogach, Regulatory Paralegal

Foreign banks are under serious scrutiny by federal and state authorities and regulators for dealing with countries blacklisted by the United States.  Almost $9 billion is what it’s costing BNP Paribas S.A. (BNP) for not obeying U.S. economic sanctions against Sudan, Iran and Cuba.  The $8.9 billion penalty was to settle U.S. Department of Justice charges that BNP willfully continued to do business with nations and entities on the U.S. sanctions list.  While a record fine, BNP is simply the latest among foreign banks that have collectively paid billions in settlements since 2009: 

01/09/09 - Lloyds TSB Bank Plc Agrees to Forfeit $350 Million in Connection with Violations of the International Emergency Economic Powers Act;

12/16/09 - Credit Suisse Agrees to Forfeit $536 Million in Connection with Violations of the International Emergency Economic Powers Act and New York State Law;

05/10/10 - Former ABN Amro Bank N.V. Agrees to Forfeit $500 Million in Connection with Conspiracy to Defraud the United States and with Violation of the Bank Secrecy Act;

08/18/10 - Barclays Bank PLC Agrees to Forfeit $298 Million in Connection with Violations of the International Emergency Economic Powers Act and the Trading with the Enemy Act;

06/12/12 - ING Bank N.V. Agrees to Forfeit $619 Million for Illegal Transactions with Cuban and Iranian Entities;

12/10/12 - Standard Chartered Bank Agrees to Forfeit $227 Million for Illegal Transactions with Iran, Sudan, Libya, and Burma; and

12/11/12 - HSBC Holdings Plc. And HSBC Bank USA N.A. Admit to Anti-money Laundering and Sanctions Violations, Forfeit $1.256 Billion in Deferred Prosecution Agreement.  

According to news sources, U.S. authorities have also begun initial settlement talks with Germany’s Commerzbank and Deutsche Bank over sanctions violations.  There are reports of at least six banks in Germany, France, Italy or Japan that are under long-running investigations and could face fines or forfeitures for processing transactions with countries or entities the U.S. has designated.

***

BSA Blast – NAFCU members can read all about BNP’s settlement and penalty in the July issue of NAFCU’s BSA Blast.  And, this issue also includes a new BSA quiz that’s oriented to Bank Secrecy Act (BSA) training for credit union board and volunteer members.   Let us know what you think. Happy BSA reading!

Funnel Accounts and Trade-Based Money Laundering Used to “Clean” Drug Proceeds

Written by Shari R. Pogach, Regulatory Paralegal

Late in May, the Financial Crimes Enforcement Network (FinCEN) issued FIN-2014-A005 advising credit unions that funnel accounts in conjunction with trade-based money laundering are increasingly being used as a way around the restrictions on U.S. cash transactions in Mexico.

 You may ask, what’s a funnel account? 

 “Funnel Account:  An individual or business account in one geographic area that receives multiple cash deposits, often in amounts below the cash reporting threshold, and from which the funds are withdrawn in a different geographic area with little time elapsing between the deposits and withdrawals.”

How is the funnel account used with trade-based money laundering (TBML)?

FinCEN’s advisory outlines how this typically works:

1. In collusion with a criminal organization, such as a drug trafficking entity, a U.S. or foreign business owner or other individual opens an account at a credit union where cash deposits can easily be received in multiple states, either through the credit union’s branches or shared branches.
2. Acting on behalf of the drug traffickers, multiple individuals deposit the cash proceeds of drug sales into the account at different branches, often in states or locations far distant from the branch where the account was opened.  Deposits are kept below the currency transaction reporting threshold trigger of $10,000.
3. After the account has built up a number of deposits, an intermediary will initiate wire transfers (or issue checks) from the funnel account to a U.S. or foreign-based business to buy goods that are then shipped to other foreign countries for sale.
4. The goods are then sold and the proceeds, in the destination country’s currency, are transferred to the drug trafficking organization with funds that have been laundered through TBML.

When such goods are sold in Mexico, a drug trafficking organization or its intermediary called a “money broker” or “peso broker” will contract with a U.S. or Mexican business owner to open a funnel account.  The peso broker directs the drug operations proceeds into the funnel account.  Payments from this account go to purchasing U.S. and foreign goods.  The goods are then shipped to Mexico and sold for pesos. 

So there you have it.  The drug trafficker has exchanged its U.S. dollar cash proceeds in the United States for Mexican pesos in Mexico through the use of the funnel account and TBML.  The criminal funds have been repatriated with apparently plausible, legitimate business transactions.

 

Enforcement is the Word; Regulatory Update Webcast; NCUA Required Board Policies Resource

Written by Shari R. Pogach, Regulatory Paralegal

In the April 2014 issue of the BSA Blast (member login needed), I wrote on FinCEN’s new push on Bank Secrecy Act (BSA) enforcement.  On April 23, after the BSA Blast was published, FinCEN assessed a civil money penalty against a Florida money services business (MSB), New Milenium Cash Exchange (NMCE) and Flor Angella Lopez, its president and owner, for willful BSA violations.  FinCEN’s action illustrates the importance of a robust anti-money laundering program, adequate training of compliance personnel, independent testing and BSA reporting.  For example:

 “…. The MSB lacked adequate AML programs for its check cashing and money order activities as well as its currency exchange transactions. The policies, procedures and internal controls were inadequate to verify the identities of persons conducting transactions, to monitor for suspicious activities, to identify currency transactions exceeding $10,000, and to ensure that NMCE filed the required currency transaction reports (“CTRs”). The internal controls were also inadequate for creating and retaining adequate Bank Secrecy Act records related to currency exchange. As NMCE’s designated compliance officer, Ms. Lopez never conducted a Bank Secrecy Act/AML risk assessment of the MSB. NMCE’s ability to detect suspicious transactions was adversely affected because no risk assessment was conducted and “red flags” were not included in the MSB’s procedures for each type of business conducted until after May 18, 2011, when a revised AML program was implemented.

NMCE failed to designate a compliance officer suitably knowledgeable of Bank Secrecy Act regulations to assure that the MSB was in compliance with applicable requirements. During the 2011 examination by the IRS SB/SE, Ms. Lopez admitted to lacking specific knowledge of the CTR reporting requirements and the recordkeeping requirement for foreign currency transactions over $1,000. Ms. Lopez also failed to establish an effective AML program, in part, by not recognizing the potential conflicts of interest in establishing a relationship with a consultant that: (1) created NMCE’s written AML program, (2) performed the only independent testing of the AML program, and (3) provided the only source of Bank Secrecy Act training for the MSB.

NMCE failed to provide adequate training and maintain records of such training for the designated compliance officer for several years. Since 2011, it has used a generic module that was provided by the consultant that also created its written AML program. The training was wholly inadequate. It was not comprehensive and was not tailored to the MSB’s specific business lines and associated risks.

NMCE also failed to conduct an independent test of the MSB for more than six years. In 2012, the MSB engaged the same consultant to conduct its first independent test despite the potential conflicts of interest. In summary, NMCE and Ms. Lopez wholly failed to implement an effective AML program.”

[…]

“Since 2010, NMCE has filed 51 CTRs totaling approximately one million dollars. All 51 CTRs were filed significantly late. NMCE, through Ms. Lopez, also failed to file at least 149 CTRs for currency received, or currency disbursed, for exchanges of currency with other financial institutions totaling more than $10,000 from November 2007 through April 2012.This represents a failure to file rate of 75%. The dollar amount involved with these transactions totaled approximately $4.5 million.”

NMCE and Ms. Lopez admitted to violating the BSA’s program, recordkeeping and reporting requirements and consented to a $10,000 civil money penalty. 

Earlier in the week several news outlets reported on a New York Times story about federal prosecutors nearing criminal charges against Credit Suisse for offering tax shelters to Americans and French bank BNP Paribas with doing business with countries such as Sudan and Iran that the U.S. has under blacklist sanctions.  The two cases could produce the first guilty plea from a major bank in more than two decades.  There are also criminal investigations into a fraud at Citigroup’s Mexican affiliate and other American banks.  The new prosecution strategy and direction is to criminally punish banks without putting them out of business and damaging the economy.

***

NAFCU Webcast - NCUA & CFPB Updates: What You Need to Know, Now - get a jump on regulatory preparedness with an update on the most critical upcoming NCUA and CFPB regulations.  Join NAFCU’s Regulatory Affairs team on Wednesday, May 7 from 2:00-3:30 pm ET, as they cover what will be new around capital reform, risk-based capital, HDMA, and more.

***

Free Resource – List of NCUA’s Required Board Policies!  Earlier this week, Andy Keeney, a nationally-recognized credit union attorney and partner at Kaufman & Canoles, provided an overview of nearly 50 “required” NCUA Board of Director policies during this NAFCU webcast.  If you missed the webcast, don’t fret: all of NAFCU’s webcasts are available for purchase on-demand as well.  Andy is also pretty well known for sharing some great resources in his firm’s Credit Union Legal Update publication.  If you check out the summer 2014 edition of Credit Union Legal Update, you’ll find the updated board policies list that Andy utilized during the above-mentioned NAFCU webcast. 

Take a look here to find other freebie publication resources available on the Kaufman and Canoles website. 

Real Life Examples Are Relatable and Can Be Useful Training Tools; Shameless Plugs

Written by Shari R. Pogach, Regulatory Paralegal

Last month I blogged that according to its 2013 annual report, the Federal Trade Commission’s (FTC’s) data indicates the number one common consumer complaint continues to be identity theft.  The FTC also reports that a significant percentage of the consumer identity theft complaints are related to tax fraud.  

Often real world examples of criminal activity can be very helpful when it comes to training your front line staff.  Such examples are relatable and can be used to get your staff talking and thinking about what to look for when interacting with members on the front line.  The Internal Revenue Service (IRS)  has a section on its site with write-ups on identity theft scenarios, Examples of Identity Theft Schemes - Fiscal Year 2014, pulled from public record documents on file within the judicial district where the cases were prosecuted.  Here are two cases from the IRS website of identity theft and other fraud specifically involving financial institutions:

“Florida Woman Sentenced for Several Fraud Schemes

On March 26, 2014, in Tampa, Fla., Latasha Callens was sentenced to 149 months in prison, five years of  supervised release and ordered to pay a $223,798 money judgment. Callens pleaded guilty on Dec. 3, 2013 to  bank fraud, access device fraud, mail fraud and aggravated identity theft. According to court documents and  statements made in court, from as early as July 2011 through her arrest in May 2013, Callens defrauded banks  and individuals on at least 58 occasions during a two-year period. In one of her schemes, Callens approached  individuals, usually at ATMs, and told them about her need to cash a check and her inability to deposit the check  into her bank account. She then convinced the individuals to deposit the checks into their own accounts and withdraw the funds for her. She sometimes gave them $100 for their trouble. In each case, the checks were worthless. They were generally drawn on closed accounts, because the checks and checkbooks had been stolen. In another scheme, for the tax years 2010, 2011, and 2012, Callen defrauded the IRS and certain taxpayers by electronically filing false and fraudulent tax returns, using stolen identities and, thereby, obtaining refunds. She sought approximately $800,000 in fraudulent tax returns.

Alabama Bank Employee Sentenced for Tax Refund Fraud

On Feb. 19, 2014 in Montgomery, Ala., LaQuanta Clayton was sentenced to 21 months in prison, three years of supervised release and ordered to pay $185,730 in restitution. Clayton pleaded guilty in July 2013 to theft of government property. According to court documents and statements made in open court, Clayton used her position as a bank teller to open bank accounts in the name of another individual without his knowledge. Tarrish Tellis, the leader of the tax-fraud ring, directed Clayton to open multiple bank accounts in order to receive electronic deposits of fraudulent tax refunds. Tellis pleaded guilty to related crimes in October 2013. Clayton would facilitate the withdrawal of this money and give it to Tellis and other individuals involved in the scheme. Clayton opened at least five bank accounts, which she used to receive fraudulent tax refunds.” (Emphasis mine.)

How do they come up with this stuff?! Speaking of training resources, here come my shameless plugs…

***

BSA Blast and BSA Quiz – The April edition of the BSA Blast is now available for NAFCU members here.  (You will need your member login to access.)  In this issue we discuss the Financial Crimes Enforcement Network’s new practice in enforcement actions against Bank Secrecy Act (BSA) violations.  There is also a challenging new BSA quiz you can use for staff training. 

Webcast - Mortgage Advertising: Keeping Your Promotions Compliant  - HELOCs vs. closed-end mortgages; social media vs. print ads—many variants determine what disclosures you must include in your mortgage advertising. Register for this webcast by May 7 to save $100 and get a clear understanding of what you need to say, when…plus essential tips and best practices for compliance adherence. 

Tumult in the Virtual Currency World, Is Bitcoin Imploding?; Programming Note

Written by Shari R. Pogach, Regulatory Paralegal

Yes, no, maybe?  It depends.  Here’s the latest on Bitcoin world.

Tokyo-based Mt. Gox, the most established and prominent Bitcoin exchange, went dark and disappeared from the Internet early Tuesday, February 25, 2014.  This occurred after a widely circulated document in Bitcoin world indicated the exchange had been hacked and lost 744,000 Bitcoins or about 6 percent of the 12.4 million Bitcoins in circulation.  Apparently the loss went unnoticed for years. At a press conference on February 28, the company’s chief executive stated the exchange had most likely lost 750,000 of its customers’ holdings and more than 100,000 of its own coins to the tune of more than $450 million. Mt. Gox filed for bankruptcy protection that same day.   Mt. Gox once accounted for four-fifths of the world’s Bitcoin trading.

Some industry observers believe the collapse of Mt. Gox occurred at a critical time for the currency as it was beginning to be more readily accepted in the mainstream.  Bitcoin ATMs have begun to pop up across North America and Tesla, OkCupid, Reddit, Overstock.com, two Las Vegas casinos, Virgin Galactic and a Subway sandwich shop in Allentown, PA accept the currency.  It is said that Ebay and the gaming company Zynga are also close to accepting the currency.   Several Bitcoin companies issued a joint statement to reassure the Bitcoin community that Mt. Gox was a one-off and “doesn’t reflect the resilience or value of bitcoin and the digital currency industry.”

A big mystery in the virtual currency world is just who is Satoshi Nakamoto a.k.a. the inventor of Bitcoin.  Last week, Newsweek magazine reported it had identified Satoshi Nakamoto as a 64-year old defense contractor living in Los Angeles, said to have worked on top secret military projects for the defense department and a major model trains enthusiast.  According to the article, Mr. Nakamoto’s second wife suspects that he developed the bitcoin protocol because he was annoyed by the bank fees and exchange rates he had to pay when wiring money overseas to purchase rare model trains.  Since then Mr. Nakamoto denied being Bitcoin’s creator and was literally chased around the city by reporters.

Bitcoin’s ease of use can also lead to easy theft – a revived online black market drug site Silk Road was hacked into and wiped out to the tune of $2.7 million in early February.  Reuters reported that Alberta-based Bitcoin bank Flexcoin closed down on March 4 after it lost bitcoins worth about $600,000 from a hacker attack.  

Here in the States, the currency has brought about the interest of the U.S. Senate, Homeland Security, the Federal Reserve, the IRS, FinCEN, the SEC and the FBI.  When the FBI closed down the original Silk Road black market last October, it seized $3.5 million in Bitcoin.  According to Bitcoin’s chief scientist, the FBI is now one of the world’s largest holders of Bitcoin. 

Although in the past the financial industry has largely been dismissive of Bitcoin that is starting to change. JPMorgan has tried to patent a bitcoin-like system.  And, a number of banks have released less negative research reports.  A Bank of America report noted that virtual currencies could become an important new part of the payment system, allowing money to move more cheaply than with credit cards and money transmitters. An industry observer believes that banks will create some form of not truly anonymous electronic cash that is more efficient than a credit card.  But to get government backing this product would likely be  quite different from bitcoin as it would have to be far less suited for criminal activity. An online marketplace, SecondMarket, plans to create and launch a bitcoin trading platform that will only open once it has several regulated financial institutions signed on as members.  

Bitcoin advocates and investors disagree on the future direction for the digital currency.  There are some that would prefer that it die rather than see it absorbed into the traditional financial system it was invented to circumvent.  But there are those Silicon Valley investors who firmly believe that regulatory oversight is necessary for Bitcoin to go mainstream.

Whatever Bitcoin’s future, it’s certainly quite a story.  William Luther, an economics professor at Kenyon College in Ohio, refers to himself as a Bitcoin skeptic but also says, “Bitcoin has brought the question of alternative currencies back to the table.  Money is a very old concept, and it’s difficult for me to think that there’s not a better way to make transactions.”

***

Programming Note.  It may be Spring break for some but it’s time for school here at NAFCU! The Regulatory Compliance team will be at NAFCU’s 2014 Regulatory Compliance School. Your compliance questions will be answered but we appreciate your patience as the team will be in and out of the office this week.

Guidance on BSA Expectations for Marijuana-Related Businesses...DOA

Written by Bernadette Clair, Senior Regulatory Compliance Counsel

Folks have had quite a bit to say about the guidance FinCEN issued earlier this month (on Valentine’s Day no less), detailing Bank Secrecy Act (BSA) compliance expectations for financial institutions looking to bank marijuana-related businesses. There have been some real gems on this issue on the Bank Lawyer’s Blog, my favorite blog for a daily fix of dark humor and extreme sarcasm, here and here.

Nobody has anything nice to say about this guidance – don’t worry, neither do I – but I may feel slightly sympathetic towards FinCEN and the banking regulators on this issue. They are a convenient target for potshots (pun intended), but they are in a bit of a spot.  After all, it remains illegal under federal law to manufacture, distribute, or dispense marijuana, and no amount of guidance they issue can solve that problem.

Although FinCEN’s guidance purports to “enhance the availability of financial services” for marijuana-related businesses, the BSA compliance headache of maintaining these accounts is not a hassle I’d be willing to take on – not based on FinCEN’s guidance, and certainly not based on concurrent enforcement guidance issued by Deputy Attorney General James Cole.  I say this based on many years of working BSA in a credit union, and knowing just how much time and effort goes into running a BSA compliance program day-in and day-out.  (Shout out to my peeps at the credit union – you know who you are!)

In addition to the due diligence you would expect, like making sure the business is duly licensed, obtaining an understanding of the expected account activity, monitoring for suspicious activity, etc., due diligence also needs to include an assessment of whether the business implicates a “Cole Memo priority.”  Essentially, because enforcement resources are limited, these “priorities” are the current areas of focus for Department of Justice attorneys and law enforcement to consider “with respect to federal money laundering, unlicensed money transmitter, and BSA offenses predicated on marijuana-related violations of the Controlled Substances Act.”  They include:

• Preventing the distribution of marijuana to minors;
•  Preventing revenue from the sale of marijuana from going to criminal enterprises, gangs, and cartels;
• Preventing the diversion of marijuana from states where it is legal under state law in some form to other states;
• Preventing state-authorized marijuana activity from being used as a cover or pretext for the trafficking of other illegal drugs or other illegal activity;
• Preventing violence and the use of firearms in the cultivation and distribution of marijuana;
• Preventing drugged driving and the exacerbation of other adverse public health consequences associated with marijuana use;
• Preventing the growing of marijuana on public lands and the attendant public safety and environmental dangers posed by marijuana production on public lands; and
• Preventing marijuana possession or use on federal property.

Absent some obvious clue, figuring out if a marijuana-related business implicates one of these priorities could require a lot of investigation, and the last time I checked, investigating criminal activity was a law enforcement function.  Haven’t we been told repeatedly that investigating alleged criminal activity reported on Suspicious Activity Reports (SARs) is the job of law enforcement, not the financial institution?

From FinCEN Guidance FIN-2012-G002:

“FinCEN continues to reiterate that institutions are not responsible for investigating the underlying suspected (or alleged) crime; investigations remain the responsibility of law enforcement. Institutions are responsible for reporting the information they know at the time they conclude that suspicious activity is present.”

Yeah, I thought so.

So what’s the real risk here? Well, enforcement priorities can change at the drop of a hat, and marijuana-related activities remain illegal at the federal level.  This excerpt from the February 14, 2014 Cole memo is warning enough for me:

“Additionally, financial institutions that conduct transactions with money generated by marijuana-related conduct could face criminal liability under the BSA for, among other things, failing to identify or report financial transactions that involved the proceeds of marijuana-related violations of the CSA. See, e.g., 31 U.S.C. § 5318(g). Notably for these purposes, prosecution under these offenses based on transactions involving marijuana proceeds does not require an underlying marijuana-related conviction under federal or state law.

[…]

Therefore, in determining whether to charge individuals or institutions with any of these offenses based on marijuana-related violations of the CSA, prosecutors should apply the eight enforcement priorities described in the August 29 guidance and reiterated above. ¹ For example, if a financial institution or individual provides banking services to a marijuana-related business knowing that the business is diverting marijuana from a state where marijuana sales are regulated to ones where such sales are illegal under state law, or is being used by a criminal organization to conduct financial transactions for its criminal goals, such as the concealment of funds derived from other illegal activity or the use of marijuana proceeds to support other illegal activity, prosecution for violations of 18 U.S.C. §§ 1956, 1957, 1960 or the BSA might be appropriate. Similarly, if the financial institution or individual is willfully blind to such activity by, for example, failing to conduct appropriate due diligence of the customers’ activities, such prosecution might be appropriate. Conversely, if a financial institution or individual offers services to a marijuana-related business whose activities do not implicate any of the eight priority factors, prosecution for these offenses may not be appropriate.” (Footnote omitted) (My emphasis added).

I’ve only touched on the due diligence issue here, so definitely give FinCEN’s guidance a read in its entirety. Also note that the burden of filing BSA reports on marijuana-related businesses – Currency Transaction Reports (CTRs) and SARs – is not lessened at all, and is in fact increased.  Marijuana-related businesses are not eligible for exemption from CTR reporting requirements and there are three new SAR filings to deal with – “Marijuana Limited,” “Marijuana Priority,” and “Marijuana Termination.” What more can I say…fun times.

****

On a lighter note, at least one enterprising kid is putting the pot munchies to good use – what better place to sell cookies than outside a medical marijuana dispensary?  All I have to say is …location, location, location!

DOJ’s “Operation Choke Point” Targets Banks’ Indirect Relationships with Payday Lenders

Written by Brandy Bruyere, Regulatory Compliance Counsel

In a move aimed at cracking down on payday lenders, the Department of Justice (DOJ) launched an investigation last year called “Operation Choke Point.” DOJ is probing whether banks allowed third-party payment processors working on behalf of payday lenders to illegally access billions of dollars from consumer checking accounts.

In essence, Operation Choke Point is an attempt to cut off some payday lenders’ “back door” entrance to traditional banking services. Like many merchants, payday lenders often use third-party payment processors to debit their customers’ checking accounts. The third-party payment processors, in turn, establish relationships with financial institutions. This allows payday lenders to indirectly access the Automated Clearing House (ACH) network to receive payments.

So what happens when a bank has an agreement with a third-party payment processor, but that third-party does business on behalf of a payday lender who is breaking the law? As it turns out, without proper due diligence, these agreements could be quite expensive for targeted financial institutions.

In its first Operation Choke Point action, DOJ filed a lawsuit against Four Oaks Bank (Four Oaks) of North Carolina. The various allegations included violations of Customer Identification Program requirements under the Bank Secrecy Act and allowing improper access to the ACH network. According to the complaint, Four Oaks worked with a third-party payment processor called TPPP-TX, which primarily represented payday lenders. Some of these payday lenders had rates of returned transactions that exceeded 30%, over 21 times higher than the national average of 1.38%. DOJ claimed that the Bank went so far as to design its internal policy for third-party payment providers to accommodate TPPP-TX despite these “extraordinarily high” return rates. Four Oaks was also accused of failing to properly identity foreign payday lenders accessing customer accounts via TPPP-TX.

Reports indicate that DOJ and Four Oaks already reached a tentative $1.2 million settlement in this case. Two members of Congress sent a letter to Attorney General Eric Holder expressing concerns about the investigation’s impact on legitimate payday lending business operations. While many credit unions do not work with third-party payment processors, this is a good reminder that third-party relationships come with additional compliance concerns. Here are some resources about managing risks stemming from relationships with third-parties including payment processors:

• NCUA Letter to Credit Unions, “Evaluating Third Party Relationships,” 07-CU-13
• NCUA's Third Party Relationships Questionnaire
• FFIEC’s BSA/AML Examination Manual, “Third-Party Payment Processors Overview”
• FinCen Advisory, “Risk Associated with Third-Party Payment Processors,” FIN-2012-A010
• FDIC Financial Institution Letter, “Payment Processor Relationships,” FIL-3-2012

***

Eye on the Olympics. Speaking of choking, I don’t know about the rest of you, but I’m a bit of a sucker for the Olympics. Maybe it’s the combination of patriotism and pageantry. Or maybe it’s that I experience a strange sense of joy watching people careen down a mountain headfirst on a tiny sled. Anyway, while figure skating is not normally my personal favorite, 19-year-old Jason Brown is an athlete to watch. Here is Jason’s impressive performance that helped earn him a trip to Sochi.

NCUA Reveals Regulatory Review Report; NAFCU's 2014 Technology and Security Conference; BSA Blast

Written by Alicia Nealon, Regulatory Compliance Counsel

Last week, NCUA’s Office of General Counsel released  its 2013 Regulatory Review report, concluding its annual review of one-third of  NCUA’s rules and regulations, which this year included CUSOs, appraisals, member business lending and the Central Liquidity Facility. The report confirms that NCUA will be addressing a number of issues that NAFCU continues to fight for to ease regulatory burden on credit unions. Particularly, the Office of General Counsel recommended that the NCUA Board consider eliminating or amending several of the regulations raised in NAFCU’s “Dirty Dozen.” 

For those of you who haven’t had a chance to see it, NAFCU prepared a list of twelve regulations- the “dirty dozen”-  that regulators need to eliminate or amend because they are unnecessary, outdated, or overly burdensome on credit unions. This Regulatory Review report affirms that NCUA is considering a number of recommendations included on the "dirty dozen" list as it reviews possible changes in rules on incidental powers, member business lending and appraisals.

The first of NAFCU’s “Dirty Dozen” is a call to expand credit union investment authority to include permissible investments in derivatives, securitization and mortgage servicing rights. The review notes that the NCUA Board may look into expanding credit unions’ incidental powers in allowing them to securitize their own loans. The agency is also expected to issue a rule on derivatives at the board meeting on Jan. 23.

The report mentions possible updates to the agency’s MBL rule, a change NAFCU pushed for as the fifth of its “Dirty Dozen.” These proposed updates would “reflect the current business climate” and address issues such as calculating market value in construction-related business loans and valuation-related issues. The report also raised the prospect of changes to the MBL rule’s personal guarantee requirement and its two-year direct experience requirement.

Addressing the final recommendation of the “Dirty Dozen,” the report recommends that the Board amend Section 722 to eliminate redundant NCUA requirements on credit unions to provide copies of appraisals upon request. 

Finally, the report acknowledges that the Dodd-Frank Act transferred the Fair Credit Reporting regulation to the CFPB and advises that Section 717 should be transferred to the CFPB. It also gives hope that NCUA may tackle other issues including modernizing advertising rules, and rules on notification of credit unions’ insurance status. 

****

NAFCU's 2014 Technology and Security Conference.  NAFCU’s 2014 Technology and Security Conference, which will be held February 11-13 in Las Vegas, is a great place to discover the latest credit union security and technology trends. Conference topics include fraud trends, core processing issues, big data and credit union crisis management.  Check out more information about the conference and register here.

****

BSA Blast – The January 2014 edition of NAFCU’s BSA Blast is now available (a NAFCU member login is needed).  This issue is all about enforcement – from FinCEN’s enhanced focus on holding financial institutions responsible for Bank Secrecy Act (BSA) violations and its enforcement action against JP Morgan Chase in connection with the Madoff scandal to recent OFAC enforcement actions against three banks. In addition the issue contains a new BSA quiz for use in staff training.

NCUA’s Supervisory Focus for 2014; NCUA Webinar on Exam Modernization

Written by Bernadette Clair, Senior Regulatory Compliance Counsel

NCUA’s Supervisory Focus for 2014.  Last Friday, NCUA released Letter 14-CU-02, detailing its 2014 examination focus. For 2014, the emphasis is heavy on risk mitigation. From the letter – “In 2014, NCUA will be working to ensure that credit unions identify and mitigate forward-looking risks before they threaten the viability of credit unions and the stability of the Share Insurance Fund.” (My emphasis.)

Specific areas of supervisory focus for 2014 include:

• Interest Rate Risk
• Cybersecurity Threats
• Money Services Businesses (MSBs)
• Private Student Lending

In addition to these specific areas of focus, the letter highlights compliance with new rules.  NCUA also says it will be looking to reallocate resources “more efficiently and effectively” and describes several steps NCUA will be taking in 2014, intended to improve and streamline the exam process – let’s hope so!

The information in this letter is invaluable for exam preparation this year, so be sure to give it a read, available here.

****

NCUA Webinar on Exam Modernization. This month, NCUA will be hosting a free webinar on its new examination report process. The webinar will provide an overview of the changes NCUA has made to streamline and improve the consistency of the examination report process, and give participants an opportunity to get a better understanding of the new procedures related to Documents of Resolution and the examination report.

This free webinar will be held on Wednesday, January 22, 2014, at 2 p.m. EST. Register here.

Participants may submit questions in advance at [email protected]. The subject line of the email should read “Examination Modernization Webinar.”

Getting to Know Bitcoin

Written by Shari R. Pogach, Regulatory Paralegal

Bitcoin has received a great deal of media attention lately, both positive and negative.  Now you may be asking yourself, so what?  Why should I be concerned or need to learn more about Bitcoin?

How about this….because it’s the forerunner of digital currency - money controlled and stored entirely by computers across the internet.  As this article, an excellent primer on Bitcoin states, it isn’t just a currency; it’s also a way of making payments, just like PayPal or a credit card network.  It lets you hold money, but not only that, Bitcoin gives you the ability to spend money and trade it, and move it from place to place. And, you can do this almost as easily as sending an email.  Bitcoin also lets a user do this all without revealing your identity. 

As Bitcoin offers semi-anonymity, it is of genuine concern to the U.S. financial community since this digital currency can be used to illegally launder money.  For example, read here about the Silk Road, the online illegal drug market that the federal government shut down.  Transactions on the Silk Road were transactions made with bitcoins. But as recent Congressional hearings indicate, digital currency is not just coming; it’s here now and must be dealt with. Although U.S. federal regulators still haven’t yet figured out how to deal with Bitcoin, the currency is doing fairly well in China, Japan, parts of Europe and Canada.  In fact, Bitcoin just opened up an ATM in Vancouver, Canada. 

Here in the States, the Department of Homeland Security closed the U.S. bank accounts belonging to Mt. Gox, generally the world’s largest Bitcoin exchange, because the Japan-based company let U.S. residents trade bitcoins for cash but didn’t register itself as a money transmitter.   This action in turn caused most U.S. financial institutions to close and drop any American Bitcoin accounts because the institutions simply didn’t want the risk.  However, as law enforcement officials emphasize, purchasing and using bitcoins is not illegal. 

As an innovator, Bitcoin may be problematic as FinCEN Director Jennifer Shasky Calvery testified during recent Congressional hearings, “So often, when there is a new type of financial service or a new player in the financial industry, the first reaction by those of us who are concerned about money laundering or terrorist finance is to think about the gaps and vulnerabilities that it creates in the financial system.”  But Shasky Calvery also noted it is “important that we step back and recognize that innovation is a very important part of our economy.”  

Smurfing’s Glamorous Cousin - Cuckoo Smurfing

Written by Shari R. Pogach, Regulatory Paralegal

What is cuckoo smurfing?  The term originated in Europe due to its similarities to the activities of the cuckoo bird.  You might remember that cuckoo birds lay their eggs in the nest of other bird species which then unwittingly take care of the cuckoo’s eggs believing them to be that of their own.  When money laundering criminals look to transfer funds through the bank accounts of innocent, legitimate customers who are expecting genuine payments from overseas you have a case of cuckoo smurfing.  What happens is the payment sends the criminal’s money to the account expecting an incoming payment, just as the cuckoo bird lays her egg in another bird’s nest.

The term might be amusing but this is complex money laundering and a bigger issue with international wire transfers.  There are four key steps in the process:

1. A legitimate customer deposits funds with a remitter, other than a bank, in a foreign country to another customer’s account in the U.S.
2. The customer isn’t aware that the remitter is part of a wider criminal syndicate looking to launder money.  This criminal remitter in the foreign country gives the details of the transfers, including the amount of funds and account details, to a criminal based in the U.S. 
3. The U.S. criminal deposits his illicit cash profits into the account of the customer waiting for the overseas transfer.  This cash is usually small amounts to avoid reporting requirements.  After the customer checks the balance, he believes the overseas transfer has been legitimately completed.
4. The U.S. criminal travels overseas and gets the legitimate funds initially deposited with the remitter.  The criminal has gotten his funds successfully laundered and simply owes a commission to the money launderer syndicate. 

This form of money laundering has been prevalent for some time overseas but the United States Secret Service believes it is becoming more widely used to launder funds through financial institutions here in the U.S.  You will want to be alert to third parties making structured or unusual cash deposits into third party accounts as this could be an instance of cuckoo smurfing activity. 

Staff BSA Training Resources; NAFCU's October 2013 BSA Blast and Best of Staff Quiz

Written by Shari R. Pogach, Regulatory Paralegal

Using real world examples of criminal activity can be helpful when it comes to training your front line staff.  Real world examples are relatable and can be used to get folks talking and more importantly, perhaps thinking about what to look for when interacting with members on the front line.  Here are some resources that you might want to refer to for case examples.

The IRS has a section on its site with write-ups on money laundering investigations, Examples of Money Laundering Investigations - Fiscal Year 2013, here’s a sample:

 “Ohio Business Owner Sentenced for Tax Evasion and Structuring Currency Deposits

On August 22, 2013, in Columbus, Ohio, Jon Scott Diamond, of Westerville, Ohio, was sentenced to 12 months and one day in prison, three years of supervised release and ordered to pay $177,183 in restitution to the IRS. Prior to sentencing, Diamond paid $57,873 to the IRS.  In addition, Diamond agreed to forfeit his interest in a 2005 BMW 645ci. Diamond pleaded guilty on March 22, 2013, to income tax evasion and to knowingly engaging in a structured currency transaction. According to court documents, Diamond owned and operated Gem Ventures, LLC, dba Gem Skill Games, which was established in December 2005. During the years 2006 through 2008, Gem Ventures distributed computerized gaming machines in various bars and clubs in or around Columbus, Ohio. In order to play the gaming machines, bar patron’s had to insert cash into them. Diamond and/or his assistant visited each establishment weekly to collect the funds and print off the weekly receipt tickets on each gaming machine. They counted the cash at the bar, compared it to the receipt printout, and reimbursed the bars for the Jack Pot prize awards. Diamond split the remaining funds with the bar owners on a 60/40 basis.  They gave the bar owners receipts for their share of the split, and left the bars with the cash. Generally, Diamond deposited the cash collections each week into a business account in the name of Gem Ventures, LLC. Between 2006 and 2008, Diamond structured the cash deposits exceeding $1 million by making numerous cash deposits in amounts just under $10,000. Diamond knew that financial institutions were legally required to report transactions exceeding $10,000 and he knowingly structured the currency transactions. In addition, for the 2006 tax year, Diamond willfully attempted to evade and defeat approximately $97,044 of income taxes due and owing to the IRS by concealing income and failing to file a federal income tax return.” 

The FBI’s website also has write-ups moneylaundering and structuring, here’s a snippet from a case:

“In April 2013, Chavez pleaded guilty to a currency structuring charge and admitted that between July 2011 and August 2011, he structured currency transactions for the purpose of avoiding federal reporting requirements for deposits and withdrawals involving more than $10,000. According to his plea  agreement, Chavez committed this crime by making 37 cash deposits and withdrawals over a 55-day period as part of a pattern of illegal activity. In his plea agreement, Chavez admitted that the purpose of his structured deposits and withdrawals was to avoid reporting requirements and thus conceal his association with Varela and his support of the Varela DTO. Chavez also admitted brokering cocaine transactions for the Varela DTO and “cleaning” its drug money by structuring financial transactions. According to the plea agreement, in November 2011, Chavez attempted to broker a 20-kilogram cocaine transaction for the Varela DTO. Chavez has been in federal custody since April 2013.”

Of course there’s always the FinCEN publication, SAR Activity Reviews:By the Numbers, and Trends, Tips & Issues , Volumes 1-23.  FinCEN puts examples of law enforcement cases in the publication and their index lists the types of criminal activity covered. 

Lest we forget, if you’re a NAFCU member you also have the “Best of NAFCU’s BSA Blast Quizzes” as a training resource.  Each of the “best of” quizzes contains twenty-five questions and answer  scenarios on BSA issues.   

So now it’s time for my “shameless plug.”

BSA Blast. NAFCU’s October 2013 BSA Blastis now available for NAFCU members.  For your reading pleasure, this issue includes:

•  A New Jersey community bank’s downfall for ignoring money exchange house business risks; and
• TD Bank’s failure to detect and adequately and timely report suspicious activities in connection with a massive Ponzi scheme. 

And, naturally, the issue also includes the “Best of NAFCU’s BSA Blast Quizzes #4.”  Happy training! 

A Different Kind of Suspicious Activity Report…..

Written by Shari R. Pogach, Regulatory Paralegal

I was listening to the news on NPR last week when a story came on about suspicious activity reports. Hearing that term, well, that naturally peaked my interest so I started listening more closely.  Imagine my perplexity when the story went on to discuss a freelance photographer in Los Angeles who likes to take pictures of industrial scenes, bridges, ports and refineries.  Huh?

Yes, apparently this photographer raises the suspicions of security guards and local law enforcement so his picture taking activities often get reported to the feds.  As a result, the photographer has had several visits from FBI agents with questions about why he’s taking such pictures.

The Nationwide Suspicious Activity Reporting Initiative is led by the Justice Department and 53 federal agencies now participate.  Under this program, suspicious activity reports include information sometimes received from community members, private security guards and via anonymous tips – everyone is encouraged to help. As a  result, many of the reports filed are problematic or useless.

A former FBI agent, Mike German, now senior policy counsel at the ACLU in Washington, DC, considers all of this to be not helpful and a waste of time.  His organization filed public records requests and was able to get 1,800 such suspicious activity reports originating from central California.  Many, if not most, examples of the suspicious activity in the copies of these reports are of people taking pictures of dams and other public structures.

Unlike financial institution suspicious activity reporting, the suspicious activity reports filed under the Nationwide Suspicious Activity Reporting Initiative appear to be publically available upon request.  So, this odd NPR story gives me the perfect opportunity to leave you with a reminder of the confidentiality of Suspicious Activity Report (SAR) filings by credit unions.  31 C.F.R. § 1020.320(e) states:  

        “(e) Confidentiality of SARs. A SAR, and any information that would reveal the existence of a SAR, are confidential and shall not be disclosed except as authorized in this paragraph (e). For purposes of this paragraph (e) only, a SAR shall include any suspicious activity report filed with FinCEN pursuant to any regulation in this
chapter.

            (1) Prohibition on disclosures by banks —(i) General rule. No bank, and no director, officer, employee, or agent of any bank, shall disclose a SAR or any information that would reveal the existence of a SAR. Any bank, and any director, officer, employee, or agent of any bank that is subpoenaed or otherwise requested to disclose a SAR or any information that would reveal the existence of a SAR, shall decline to produce the SAR or such information, citing this section and 31 U.S.C. 5318(g)(2)(A)(i), and shall notify FinCEN of any such request and the response thereto.

           (ii) Rules of Construction.Provided that no person involved in any reported suspicious transaction is notified that the transaction has been reported, this paragraph (e)(1) shall not be construed as prohibiting:

            (A) The disclosure by a bank, or any director, officer, employee, or agent of a bank, of:

            ( 1 ) A SAR, or any information that would reveal the existence of a SAR, to FinCEN or any Federal, State, or local law enforcement agency, or any Federal regulatory authority that examines the bank for compliance with the Bank Secrecy Act, or any State regulatory authority administering a State law that requires the bank to comply with the Bank Secrecy Act or otherwise authorizes the State authority to ensure that the bank complies with the Bank Secrecy Act; or

            ( 2 ) The underlying facts, transactions, and documents upon which a SAR is based, including but not limited to, disclosures:

            ( i ) To another financial institution, or any director, officer, employee, or agent of a financial institution, for the preparation of a joint SAR; or

            ( ii ) In connection with certain employment references or termination notices, to the full extent authorized in 31 U.S.C. 5318(g)(2)(B); or

            (B) The sharing by a bank, or any director, officer, employee, or agent of the bank, of a SAR, or any information that would reveal the existence of a SAR, within the bank's corporate organizational structure for purposes consistent with Title II of the Bank Secrecy Act as determined by regulation or in guidance.

            (2) Prohibition on disclosures by government authorities. A Federal, State, local, territorial, or Tribal government authority, or any director, officer, employee, or agent of any of the foregoing, shall not disclose a SAR, or any information that would reveal the existence of a SAR, except as necessary to fulfill official duties consistent with Title II of the Bank Secrecy Act. For purposes of this section, “official duties” shall not include the disclosure of a SAR, or any information that would reveal the existence of a SAR, in response to a request for disclosure of non-public information or a request for use in a private legal proceeding, including a request pursuant to 31 CFR 1.11.” 

FinCEN Shake-Up; July 2013 BSA Blast and Best of Staff Quiz

Written by Shari R. Pogach, Regulatory Paralegal 

FinCEN Shake-Up. The Financial Crimes Enforcement Network (FinCEN) has gone through a major reorganization under Director Jennifer Shasky Calvery.  The agency reorganization is meant to create more opportunities for cross training and greater staff interaction. Now, FinCEN’s employees are organized by job function:  financial intelligence analysts in the Intelligence Division, policy specialists in the Policy Division; liaison, outreach and call center personnel in the Liaison Division; and staff members responsible for exercising the agency’s regulatory enforcement authorities in the Enforcement Division.  According to Shasky Calvery, FinCEN’s new structure will allow information developed by an analyst in the Intelligence Division to be more easily provided to law enforcement, regulators, foreign partners and industry so all can better carry out their responsibilities.

FinCEN Administrative Announcements. Here are some additional FinCEN administrative announcements of interest: 

• The “Forms” webpage has been re-titled because almost all of FinCEN’s reports must now be e-filed.  The updated “Filing Information” page includes links to filing instructions, FAQs and the money services businesses (MSB) registrant search.  And, to avoid mistaken filings of sample forms, the agency has relocated them to its BSA E-Filing Test System.

• FinCEN acknowledged that credit unions may have administrative difficulties submitting Bank Secrecy Act (BSA) reports electronically within required timeframes due to natural disasters, emergency situations or other systemic issues in FIN-2013-G002.    On such occasions, credit unions should contact FinCEN’s Regulatory Helpline at 1/800-949-2732, or outside the U.S. at 1-703-905-3975, to inform the agency and determine possible alternatives for timely BSA reporting.  The agency will then work with credit unions to develop necessary alternatives.

• Individuals claiming to be employees of FinCEN and the U.S. Department of the Treasury have attempted to solicit funds from unsuspecting victims in ongoing financial scams.  FinCEN has issued an alert reminding the public to be wary of fraudulent correspondence and phone calls.  

***

BSA Blast. And now, for a “shameless plug.” NAFCU’s July 2013 BSA Blast is available for NAFCU members.  For your reading pleasure this issue includes:

• The Liberty Reserve alleged money laundering case;
• FinCEN’s FAQ Resource on electronic filing; and
• A review of trends in Suspicious Activity Report filings
  concerning accountants and depository institution insider abuse.

And, naturally, the issue also includes the “Best of NAFCU’s BSA Blast Quizzes #3.”  You now have an additional twenty-five questions and answers at your disposal to stump train your staff on the BSA.

***

Congressional Caucus. FinCEN Director Jennifer Shasky Calvery is speaking at NAFCU’s Congressional Caucus this September. The deadline for early-bird registration savings is this Friday, July 19. NAFCU members and nonmembers can save $100 on their registration fee by registering before the deadline. Caucus runs Sunday, September 8–Wednesday, September 11 at the Mayflower Renaissance Hotel in Washington, DC.

Where, Oh, Where Does My SAR Go?

Written by Shari R. Pogach, Regulatory Paralegal     

             Recently JiJi, Bernadette and I attended a one-day seminar on information sharing and best practices related to the Bank Secrecy Act and Anti-Money Laundering (BSA/AML).  Hosted by local law enforcement, the seminar offered a window into how the other side views the multitude of Suspicious Activity Reports (SARs) that financial institutions file.

            For example, did you know that SAR filings were originally transcribed into continuous lines of all capitalized type and no grammar?  Law enforcement readers used rulers in order to get through the material without going blind.  FinCEN’s upgrades and changes to the BSA forms and reporting process has apparently made reading transcribed SAR material a little easier on the eyes today though. 

             Law enforcement is aware that financial institutions over file.  There will likely continue to be some push pull when it comes to satisfying regulatory responsibilities versus the utility of SARs to law enforcement. 

             Here’s what law enforcement suggests about writing and submitting an effective SAR narrative:

• Don’t just give the facts, explain why you think the activity is suspicious;
• Remember you should be telling a story with your narrative;
• Opening your narrative with the background and history of your credit union is not necessary; and
• Be prepared to back-up the reason for the SAR with staff witnesses and supporting documentation, for example, if based on a conversation a teller had with a member, the teller should not later forget the conversation.

             Although it often seems as though all those SAR filings disappear into a black hole, this isn’t the case.  For instance, the Asset Forfeiture and Money Laundering Section of Maryland’s U.S. Attorney’s Office may receive several hundred SARs a month, equivalent to half a ream of copy paper, just on possible money laundering activity.  Out of those only six or ten cases may be selected for further investigation. Why are they selected?  Selection is based upon a compelling reason such as the size, volume or type of incident.  But just this year, 23 of their cases have resulted in seizure, 11 indictments, nine convictions, one pending, one fugitive and five civil resolutions.  And, sometimes cases may be pursued based on a lesser charge, such as structuring, simply because law enforcement couldn’t prove other than that.

             The goal for law enforcement is to successfully partner with financial institutions and exchange information in order to catch the “bad guys.”  You might try contacting your local law enforcement to see if they’re willing to come to your credit union and educate your staff on suspicious activity and trends in your area.  It might not lessen the burden of filing those SARs but it will help understand their value to law enforcement.

FinCEN's CTR FAQs Continued

Written by Michael Coleman, Regulatory Compliance Counsel

Yesterday we blogged about the Financial Crimes Enforcement Network's (FinCEN) recently issued frequently asked questions (FAQs) regarding SARs, and FAQs regarding CTRs. Today we'd like to take a closer look at the CTR  FAQs. Specifically, a couple of the FAQs which address issues that we have received questions about concerning the filing of the new CTR forms.

The CTR FAQs are very detailed and provide valuable insight and examples into the process of filing the new CTR form. Many of the FAQs deal with the technical process of filing the CTR, but there are also many FAQs that concern the substance of the form and provide examples of how to fill out sections of the new form. Here are a couple CTR FAQs that you might find useful: 

"12. What is the timeframe for filing the FinCEN CTR? I have seen both 15 and 25 days referenced.

FinCEN regulations have consistently maintained a regulatory requirement that CTRs be filed within 15 days. The 25-day period was implemented, in connection with receipt of magnetic media files (ended December 2008), to account for physically transporting (shipping) the magnetic media to the processing center in Detroit, Michigan. FinCEN understands that this business practice had continued with respect to batch e-filing, particularly considering previous public guidance referencing the 25-day period.

In light of the comments received and acknowledging that some financial institutions may have needed to change their business processes to become compliant with the rules, FinCEN determined that it would temporarily maintain the 25-day compliance period referenced in its earlier specifications until March 31, 2013, for those filers that needed to update their systems in order to be in compliance with the established regulatory requirements. This temporary extension to the filing requirements was to allow sufficient time for filers to adjust submission schedules to meet established regulatory requirements.

As of April 1, 2013, all FinCEN CTRs must be filed within 15 calendar days of the reported transaction(s)."

 [...]

15. I am filing the FinCEN CTR on an entity; however, the selections in Item 2a-2c all reference a person. What selection would I choose when filing on an entity?

Under the BSA regulations, the definition of “person” found at 31 CFR 1010.100(mm) is “an individual, a corporation, a partnership, a trust or estate, a joint stock company, an association, a syndicate, joint venture, or other unincorporated organization or group, an Indian Tribe (as that term is defined in the Indian Gaming Regulatory Act), and all entities recognizable as legal personalities.” Since an entity cannot physically conduct a transaction, the only selection that would apply is 2c “Person on whose behalf transaction was conducted.” In addition, if filing on an entity, a filer must select the checkbox (Item 4b) for “If entity” in Part I.

If more than one Item 2 option applies to a person involved in the transaction(s), filers should complete only one Part I on that person with only one entry in Item 2 pursuant to the following construct:

When to select Option 2a: In addition to when only Option 2a applies, filers should select Option 2a “Person conducting transaction on own behalf” if 1) Options 2a, 2b, and 2c apply; 2) Options 2a and 2b apply; or 3) Options 2a and 2c apply.

When to select Option 2b: In addition to when only Option 2b applies, filers should select Option 2b “Person conducting transaction for another” if both Options 2b and 2c apply and Option 2a does not apply.

When to select Option 2c: Filers should select Option 2c “Person on whose behalf transaction was conducted” only on the person for whom the transaction is conducted. This person cannot have other roles within the transaction or the options would apply.

When to select Option 2d: In addition to when only Option 2d applies, filers should select “Courier Service (private)” if multiple options that include 2d “Courier service (private)” apply."

 As JiJi mentioned yesterday, these FAQ documents are must read materials if you are responsible for BSA compliance at your credit union. 

The Newest SAR and CTR FAQs from FinCEN

Written By JiJi Bahhur, Regulatory Compliance Counsel

Last Friday, the Financial Crimes Enforcement Network (FinCEN) released two sets of frequently asked questions(FAQs): FAQs Regarding SARSs and FAQs Regarding CTRs.  The purpose of these questions is to assist financial institutions with the use of FinCEN’s new SAR and CTR forms, which, as of April 1, 2013, are the only acceptable forms for reporting suspicious activity and applicable currency transactions – an item we’ve blogged about on numerous occasions. 

The FAQs are very detailed, and if you have any dealings with SARs or CTRs at your credit union, I’d suggest you read through them.  As someone who used to be heavily involved in filling out and filing CTRs and SARs, I can say that even I learned a few new things.  Here’s a taste of information from the FAQs Regarding SARs:

“1. What are the expectations for completing the Items with an asterisk (“critical”) and without an asterisk (“non-critical”) found on the FinCEN SAR or any other FinCEN report?

As explained in FinCEN’s March 2012 guidance (FIN-2012-G002), for both critical and non-critical elements, financial institutions should complete those Items for which they have relevant information, regardless of whether or not the individual Items are deemed critical for technical filing purposes.

For critical Items, financial institutions must either provide the requested information or affirmatively check the “Unknown” (Unk.) box that is provided on the FinCEN SAR and FinCEN Currency Transaction Report (CTR) (or any other FinCEN Report).

For non-critical Items, FinCEN expects financial institutions will provide the most complete filing information available within each report consistent with existing regulatory expectations. Based upon feedback from law enforcement officials, such information is important for query purposes. However, the new FinCEN SAR and FinCEN CTR do not create any new obligations to collect data, either manually or through an enterprise-wide IT management system, where such collection is not already required by current statutes and regulations, especially when such collection would be in conflict with the financial institution’s obligations under any other applicable law. Therefore, a financial institution may leave non-critical fields without an asterisk blank when information is not readily available.

2. How do I meet my underlying obligation to submit a complete and accurate report if my filing software does not allow me to include known information for a field without an asterisk?

FinCEN expects financial institutions to have the capability to submit information for any of the data fields in the FinCEN SAR or CTR (or any other FinCEN report). In general, if your financial institution’s filing software does not permit the institution to include information in a field without an asterisk where information has been collected and is pertinent to the report, the financial institution should instead complete a discrete filing for those transactions until the software is updated. If a filing has been submitted in which such information was not included because of such a limitation in the filing software, an amended filing should be completed using either the discrete filing method or an amended batch filing, once the software is updated. Such software updates should be implemented within a reasonable period of time.

If your institution has questions regarding the applicability of this general guidance, please contact the FinCEN Regulatory Helpline at (800) 949-2732 for further information.”

 

NCUA Report; FinCEN SAR Activity Review

Written by Bernadette Clair, Regulatory Compliance Counsel

The May issue of the NCUA Report is now available. This issue includes the following:

• Office of Examination and Insurance Report: Demystifying Capital Requirements for Credit Unions – Part 2

• Chairman’s Corner: Secure Liquidity Sources While the Sun is Shining

• Board Actions: Share Insurance And Stabilization Funds Remain on Sound Footing

• Board Perspective: Everyone Comes Out a Winner

• Electronic Banking Threats and Security

• Mobile Banking Offers Credit Unions New Ways to Attract Members, Offer Value

• Deadline for Consulting Service Nominations is May 31

• FFIEC Appraisal Complaint Hotline Opens

• NCUA Discontinues Mailing Regulatory Letters to Credit Unions; Will Send by Email Instead

There are a few good reads in this issue, and we’ll take a closer look at Electronic Banking Threats and Security tomorrow.

****

FinCEN SAR Activity Review.  FinCEN has released its 23^rd Issue of the SAR Activity Review – Trends, Tips & Issues, as well as the 18^th Issue of the SAR Activity Review – By the Numbers. These two reports are an excellent source of information on the latest trends and numbers in suspicious activity reporting.

The Buck Stops Here: Improving U.S. Anti-Money Laundering Practices

Written by Bernadette Clair, Regulatory Compliance Counsel

Last week, U.S. Senators Dianne Feinstein (D-Calif.) and Chuck Grassley (R-Iowa), co-chairs of the Senate Caucus on International Narcotics Control, released a report on strengthening anti-money laundering (AML) practices in the U.S. The report, entitled The Buck Stops Here: Improving U.S. Anti-Money Laundering Practices, is intended to “outline the scope of the problem, describe the U.S. anti-money laundering framework and its main gaps and propose solutions for how we can best strengthen our anti-money laundering laws.”

A press release on the report highlights several recommendations:

• Stronger enforcement of anti-money laundering laws by the Justice Department, particularly in cases where banks are accused of improperly monitoring billions of dollars in illicit proceeds;

• Making pre-paid cards (known as stored value) subject to cross-border reporting requirements;

• Closing a loophole that makes armored cash carriers exempt from reporting requirements;

• Passage of the Incorporation Transparency and Law Enforcement Assistance Act to make it more difficult for criminal organizations to hide behind shell companies;

• Passage of the Combating Money Laundering, Terrorist Financing and Counterfeiting Act to close gaps in anti-money laundering laws; and

• Enforcement of the 2007 National Money Laundering Strategy, including the requirement that all money service businesses register with the Treasury Department’s Financial Crimes Enforcement Network.

In addition to pushing for additional action on the legislative and regulatory fronts, the report urges stronger enforcement of current laws by the Department of Justice, so that penalties for noncompliance with BSA requirements will not be viewed simply as a cost of doing business.  From the report:

"STRONGER DEPARTMENT OF JUSTICE ENFORCEMENT

 1. Finding: On December 11, 2012, HSBC, one of the largest banking and financial services institutions in the world, agreed to pay a $1.92 billion settlement to federal and state authorities for charges that they failed to maintain an effective anti-money laundering program. U.S. authorities charged that HSBC had allowed over $200 trillion in wire transfers to enter the United States unmonitored, including $670 billion in wire transfers from Mexico and at least $881 million laundered by Mexican and Columbian drug traffickers. In addition, over $9.4 billion in physical money entered the United States from Mexico unmonitored. Similarly, in 2010, Wachovia agreed to pay $160 million to settle charges that its weak anti-money laundering compliance program enabled more than $373 billion to enter the bank unmonitored as required by law, $110 million of which was shown to be  Mexican drug money.1 In both cases, no individuals were criminally prosecuted by the Department of Justice.

Recommendation: The Caucus calls on the Department of Justice to fully enforce existing criminal sanctions against both the financial institutions and the individuals knowingly and intentionally responsible for the criminal activity more forcefully in major money laundering cases involving foreign and domestic financial institutions. Without serious consequences for those who break the law, financial institutions will continue to avoid compliance with U.S. anti-money laundering rules and regulations. Strong enforcement of federal law against financial institutions and employees who knowingly and  intentionally engage in money laundering activities will ensure that the risk of working with criminals is far greater than the illicit profits those criminal activities produce. Without tough and appropriate penalties, sanctions will simply remain the cost of doing business for financial institutions." (emphasis added)

The report makes for an interesting read and can be found here.

NCUA Report: Beware of Three Emerging BSA Risks

Written by Bernadette Clair, Regulatory Compliance Counsel

The April issue of the NCUA Report is now available. This issue includes the following:

• Office of Examination and Insurance Report: Demystifying Capital Requirements for Credit Unions

• Chairman’s Corner: Wearing a Different Hat

• Board Actions: Streamlined Fixed Assets Rule Proposed

• Board Perspective: Derivative Investment

• Economic Scenarios to Prepare for in 2013

• Q&A with the Director of the Office of Consumer Protection

• Beware of Three Emerging BSA Risks

• The User Experience Guides Mycreditunion.gov and Pocket Cents Redesign

• Register Now for NCUA’s CEO Boot Camps

• Take a Trip to Financial Stability with NCUA’s New Personal Finance Game

I want to highlight one of the articles –Region III’s Report Beware of Three Emerging BSA Risks. This article discusses three services increasingly offered by credit unions that can significantly increase BSA risk – money services businesses accounts, reloadable prepaid cards and remote deposit capture.  For example, the article has this to say about the BSA risk related to remote deposit capture (RDC):

“A rapidly growing electronic service that credit unions are offering to business account members (and some individual account holders) is RDC service. RDC is an automated deposit transaction delivery system enabling members to scan items—typically checks—from remote locations and electronically transmit the electronic images or captured digital data to credit unions for posting and clearing. While only 503 federally insured credit unions currently offer RDC service, this figure represents a 42.5 percent increase from the end of 2011.

The potential use of this service as a way to launder money is a risk associated with RDC. In particular, inadequate internal controls necessary to manage the anti-money laundering risk posed by RDC activity and insufficient automated transaction monitoring systems are two common deficiencies identified in recent FinCEN enforcement actions.

Before offering RDC to members, credit union management must assess all of the risks associated with the service, including BSA compliance, and develop and implement policies and procedures to mitigate those risks. Credit unions should ensure that their transaction monitoring systems adequately capture, monitor and report suspicious activities occurring through remote deposit capture.”

The article also serves as a reminder to credit unions that BSA risk should be one of the areas addressed during the development of new products and services.  From the conclusion of the article:

“In Region III, we have noticed that while management often addresses the financial, operational and legal risks in servicing new categories of members and offering new products and services, they may forget to include addressing BSA risks. When developing a new program or service, we recommend including the BSA Compliance Officer at the outset. This will prevent a lot of headaches when examiners come.”  (my emphasis)

 Takeaway: save yourself a headache and make sure evaluating BSA risk is incorporated into your credit union’s product and service development process if it isn’t already!

BSA Deficiencies Result in $10 Million Civil Money Penalty; April 2013 BSA Blast and Best of Staff Quiz #2

Written by Shari R. Pogach, Regulatory Paralegal

I simply love it when banks provide me with material when it comes time to write the BSA Blast.  In NAFCU’s April 2013 BSA Blast we have the example of TCF National Bank (TCF) in Sioux Falls, South Dakota being so off the mark with their BSA compliance practices they were slapped with a $10 million civil money penalty.  A review of account and transaction activity from November 2008 through July 2010 resulted in TCF’s late filing of 2,357 Suspicious Activity Reports (SARs) describing suspicious activity with transactions of $70 million.  TCF’s Board and management were ordered to take specific action and revamp the bank’s BSA compliance program. 

The April 2013 issue of the BSA Blast is now available for NAFCU members.  In addition to TCF’s BSA compliance deficiencies we highlight FinCEN’s list of prohibited words when completing the electronic Suspicious Activity Reports (FinCEN SARs) and Currency Transaction Reports (FinCEN CTRs). 

We’ve also made a change to the BSA Blast format with this latest issue.  It’s called the BSA Beat where we cover BSA news of note. 

And, of course, the second of the “Best of NAFCU’s BSA Blast Quizzes” is part of this issue.  These updated 25 questions with the associated answer key should make a useful training tool for both new and experienced credit union staffers.

For those of you who have taken the quizzes, I often wonder if you’ve caught on to the rather unusual sounding names that are featured in the questions.  If they sound familiar, that’s because they are:  I love movies and make references to them in my questions.  And, I try not to use the lead character names so as not to make it obvious.  Just a little trivia extra, I hope you enjoy!

Note:   If your credit union is a NAFCU-member and you'd like to receive an email update when the BSA Blast is available each quarter, just send us an email.

A Final Farewell to the Legacy Forms; eCFR Updated to Reflect ATM Disclosure Amendments; Happy Weekend from the Twins

Written By JiJi Bahhur, Regulatory Compliance Counsel

With April 1 approaching, I thought today would be a good time to remind you all that after March 31, 2013, the legacy reports can no longer be used for filing SARs and CTRs.  Starting April 1, 2013, the new SAR and CTR forms must replace the legacy forms if you have not already said your goodbyes to those forms. 

For more information, check out FinCEN’s guidance on this matter and past blog posts written by NAFCU’s Compliance Team (here, here, and here). 

***

In last Friday’s blog post, Steve mentioned that the CFPB issued a final rule requiring the removal of the Regulation E requirement to place ATM fee disclosure language “on the machine.” He also mentioned that the final rule would be effective immediately upon publication in the Federal Register.  Well, as of March 26, 2013, the final rule has been published in the Federal Register.  And on a grander note, the language has already been removed from the Electronic Code of Federal Regulations, thus making everything consistent. 

    “§ 1005.16   Disclosures at automated teller machines.

     (a) Definition. “Automated teller machine operator” means any person that operates an automated teller machine at which a consumer initiates an electronic fund transfer or a balance inquiry and that does not hold the account to or from which the transfer is made, or about which an inquiry is made.

    (b) General. An automated teller machine operator that imposes a fee on a consumer for initiating an electronic fund transfer or a balance inquiry must provide a notice that a fee will be imposed for providing electronic fund transfer services or a balance inquiry that discloses the amount of the fee.

    (c) Notice requirement. An automated teller machine operator must provide the notice required by paragraph (b) of this section either by showing it on the screen of the automated teller machine or by providing it on paper, before the consumer is committed to paying a fee.

    (d) Imposition of fee. An automated teller machine operator may impose a fee on a consumer for initiating an electronic fund transfer or a balance inquiry only if:

     (1) The consumer is provided the notice required under paragraph (c) of this section, and

     (2) The consumer elects to continue the transaction or inquiry after receiving such notice.”

Now when credit unions research Regulation E, the regulation matches the underlying law! Imagine that!

***

The twins and I intend to just relax this weekend.  We hope you can do the same!

Vendor Risk Management - Compliance Considerations

Written by Steve Van Beek

Back in May 2012, the Philadelphia Federal Reserve's Consumer Compliance Outlook webinar series discussed Vendor Risk Management - Compliance Considerations (the slides are available here). The Fourth Quarter 2012 Consumer Compliance Outlook publication included an article that provides highlights of the main themes. As you can see from the headings and subheadings, this article is a must read:

Vendor Risk Management - Compliance Considerations

QUESTIONS ABOUT THIRD PARTIES

What Are Common Types of Third-Party Relationships?

What Are the Risks of Using Vendors?

PRACTICES THAT INCREASE THE RISK OF VIOLATIONS

• Overreliance on third-party vendors.
• Failure to train new staff or retain knowledgeable staff.
• Failure to adequately monitor the vendor.
• Failure to set clear expectations.

EXAMPLES OF VENDOR RISK MANAGEMENT COMPLIANCE ISSUES

Flood Insurance Monitoring

Loan Modifications

Credit Card Administration

Disclosure Software

Revenue Enhancements

BEST PRACTICES

• Due diligence.
• Risk assessment.
• Clear contractual expectations.
• Comprehensive monitoring program.
• Board oversight.

CONCLUSION

Vendors provide value in the expertise and experience they offer; however, financial institutions must still maintain active oversight. It is important to remember that when a vendor performs a service or function, the institution bears ultimate responsibility for compliance. Because varying levels of risk remain with the institution that offers the product or service, a strong vendor risk management program is key to maintaining compliance and avoiding claims of improper treatment of bank customers. With good vendor management, banks can minimize the risk of less direct oversight or control and maximize the benefits gained through a well-managed vendor relationship. Specific issues about vendor risk management should be raised with your primary regulator.

Again, I recommend reviewing the full article and passing it along to your colleagues.

***

I also wanted to highlight the subsection on board oversight - which states:

"Board oversight. Keeping the board of directors properly informed about the vendor management program is key to ensuring that they can provide proper oversight and that the bank’s management process addresses the risks inherent in third-party relationships. The board should review the vendor management policy, due diligence reports, risk assessments, and monitoring results."

Board of Directors & Risk Management. Risk management and the role of the credit union's board of directors will be the focus of my colleague Anthony Demangone's presentation at NAFCU's upcoming Board of Directors and Supervisory Committee Conference.

Additionally, I'll be presenting on How the CFPB Impacts Your Credit Union and will include a discussion of the CFPB's latest actions related to "unfair, deceptive or abusive acts or practices" (UDAAP) - including how the actions of third-parties resulted in liability for the financial institutions. If your board is considering attending, sign up by Friday, March 29th to Save $100.

***

NAFCU's Online Training Program also includes 14 courses for credit union boards - including one on Risk Management.