NAFCU Compliance Blog

OFAC Blacklists the "Thieves-in-Law" Crime Syndicate; January 2018 BSA Blast

Written by Shari R. Pogach, Regulatory Paralegal

Thieves-in-Law, another organized criminal network to be on the lookout for.  And, no, this is not a joke..................

Late last month, the U.S. Department of the Treasury's (Treasury) Office of Foreign Assets Control (OFAC) announced it was targeting one of Russia's oldest and most notorious organized criminal gangs – "Vory v Zakone" or "Thieves-in-Law" (Thieves).  The announcement indicated the criminal network was being targeted for "its involvement in serious transnational criminal activities" across the globe. Ever heard of them?  I hadn't.

As a group, the Thieves-in-Law originated in the former Soviet Union's Stalinist prison camps and gulags.  This Wikipedia entry provides some history along with the rules of conduct for its members.  Members are required to have served several jail sentences, not allowed to get married and take an oath to uphold the group's code that includes living only off their criminal profits and supporting other Thieves members.

Now, apparently, its members are the heads of a vast underworld network that has spread throughout the former Soviet Union, Europe and the United States to the great financial centers.  As a criminal organization, it has engaged in money laundering, extortion, bribery, robbery, identity theft and trafficking.

Individual Thieves engaging in criminal activity in the United States have been targeted by U.S. law enforcement before, but Treasury's designation of the whole network as a "Transnational Criminal Organization" is the first action to treat them as a single group. As OFAC Director John E. Smith stated, “Treasury is designating the Thieves-in-Law as part of a broader strategy to disrupt the financial infrastructure of transnational criminal organizations that pose a threat to the United States and our allies.”      

The Treasury action also targeted 10 individuals and two entities linked to the Thieves-in-Law organization.  This action generally prohibits U.S. persons from conducting financial or other transactions with these individuals and entities, and freezes any assets they may have under U.S. jurisdiction.

***

BSA Blast.  It's 2018 and the first quarter January issue of the BSA Blast is now available. (NAFCU login required).  The articles in this issue cover: 1) a Texas community bank's civil money penalty lesson on the importance of "Knowing Your Customer"; and 2) Citibank's banking regulator fines it $70 million for not correcting its BSA/AML compliance issues.  The BSA training quiz included in this issue focuses on Currency Transaction Reports (CTRs).

Domestic ACH Transactions: To OFAC or Not to OFAC, That is the Question; Programming Note

Written by Shari R. Pogach, Regulatory Paralegal

Wade Gustafson is sending a domestic ACH to Jean Lundegaard through your credit union.   Should an Office of Foreign Assets Control (OFAC) check be run on both Mr. Gustafson (originating party) and Ms. Lundegaard (the recipient)? And, should this be performed in real-time to allow for the transaction to be stopped? 

The conundrum here is that there isn’t a specific regulatory requirement that will tell you which transactions to run against OFAC. If a credit union facilitates a prohibited transaction, there is an OFAC violation. So, each credit union has to come up with an OFAC compliance program designed to ensure compliance based on the institution’s own risk. That basically means these accounts – and their related OFAC risks – should be addressed in your risk assessment, and then your policy designed to mitigate that risk.

The Federal Financial Institutions Examination Council's (FFIEC) Bank Secrecy Act/Anti-Money Laundering (BSA/AML) Examination Manual has a section on OFAC compliance and ACH transactions that discusses the expectations for Originating Depository Financial Institutions (ODFIs) and Receiving Depository Financial Institutions (RDFIs). It essentially appears to say that ODFIs are responsible for verifying the status of the originator and RDFIs are responsible for verifying the status of the receiver/beneficiaries. In the section (pp. 217-224) on Automated Clearing Transactions – Overview, the manual states:

"Because of the nature of ACH transactions and the reliance that ODFIs and RDFIs place on each other for OFAC reviews and other necessary due diligence information, it is essential that all parties have a strong CDD program for regular ACH customers.

[...]

With respect to domestic ACH transactions, the Originating Depository Financial Institution (ODFI) is responsible for verifying that the Originator is not a blocked party and making a good faith effort to ascertain that the Originator is not transmitting blocked funds. The Receiving Depository Financial Institution (RDFI) similarly is responsible for verifying that the Receiver is not a blocked party. In this way, the ODFI and the RDFI are relying on each other for compliance with OFAC regulations.

If an ODFI receives domestic ACH transactions that its customer has already batched, the ODFI is not responsible for unbatching those transactions to ensure that no transactions violate OFAC's regulations. If an ODFI unbatches a file originally received from the Originator in order to process "on-us" transactions, that ODFI is responsible for the OFAC compliance for the on-us transactions because it is acting as both the ODFI and the RDFI for those transactions. ODFIs acting in this capacity should already know their customers for the purposes of OFAC and other regulatory requirements. For the residual unbatched transactions in the file that are not "on-us," as well as those situations where banks deal with unbatched ACH records for reasons other than to strip out the on-us transactions, banks should determine the level of their OFAC risk and develop appropriate policies, procedures, and processes to address the associated risks. Such policies might involve screening each unbatched ACH record. Similarly, banks that have relationships with third-party service providers should assess those relationships and their related ACH transactions to ascertain the bank's level of OFAC risk and to develop appropriate policies, procedures, and processes to mitigate that risk." (Emphasis added).

The BSA/AML Examination Manual indicates noncustomer transactions should be checked against OFAC lists prior to being executed. Although the manual discusses these "responsibilities" as being separated, the duty on both financial institutions to prevent prohibited transactions from occurring is absolute. Both institutions are completely responsible for not facilitating a prohibited transaction.

If the credit union has a particular relationship with another institution (beyond mutual participation in NACHA), there could be contractually-agreed processes for running OFAC checks or due diligence conducted that might justify a decision not to run checks on everyone.  Still reliance on the NACHA rules does not necessarily appear to be sufficient. NACHA issued its own OFAC compliance whitepaper, which states:

“…In terms of the ACH Network, this means that all U.S. ACH participants, including Originators, Originating Depository Financial Institutions (ODFIs), Receiving Depository Financial Institutions (RDFIs), Receivers and third-parties need to be aware that they can be held accountable for sanctions violations by the U.S. Government and must understand their compliance obligations.

[…]

Debit Entries: In the event that the ODFI inadvertently processes an unlawful ACH debit entry to a blocked account, the RDFI holding the blocked account (or an intermediary receiving point such as a correspondent or third-party processor able to identify the transaction), in compliance with OFAC policies, should return the entry in accordance with the NACHA Operating Rules using Return Reason Code R16 (Account Frozen). In this way, the proceeds do not leave the blocked account and the ODFI is informed of the reason.”

The expectation is that ODFIs and RDFIs will work together to prevent OFAC violations. However, NACHA emphasizes that the ODFI also bears the responsibility to make a good faith effort to determination that the originator is not transmitting funds to a blocked party. Similarly, the RDFI is also responsible for knowing and responding properly if a transaction is made from a party subject to sanctions. Ultimately, there is not a "right" answer to this question. It is a question of risk-based decision-making for the credit union and the expectations of the credit union's examiners.

***

Programming Note.  NAFCU will close at noon today and be closed on Monday for the holiday weekend. We will be back to blogging on Wednesday.

NAFCU's compliance attorneys are in San Diego, California,  the rest of next week at the fall session of Regulatory Compliance School and the 2017 Regulatory Compliance Seminar.   We appreciate your patience as your compliance questions will be answered, but our replies might be slightly delayed with the time difference.

Enjoy your weekend!

OFAC Requirements for Blocked Property

Written by Stephanie Lyon, Regulatory Compliance Counsel

Last Friday, the Office of Foreign Assets Control (OFAC) released a notice reminding credit unions and other financial institutions that the annual report of blocked property is due by September 30th. As the annual filing is only one of the multiple OFAC requirements for blocked property, we thought it would be helpful to break down the other steps a credit union must take to meet its regulatory requirements.

In general, OFAC regulations require that credit unions block accounts and other property as well as reject unlicensed trade and financial transactions of certain countries, entities, and individuals. See, FFIEC BSA/AML Examination Manual, pp. 147. Aside from that, you may remember that NAFCU blogged earlier this year and noted that OFAC takes a risk-based approach to compliance so credit unions will have the flexibility of determining when and how to run transaction names through OFAC lists. So what happens once the credit union identifies property subject to a blocking program?

Place Funds in Interest-Bearing Accounts

Once the credit union has determined that funds need to be blocked, the blocked property must be placed into an interest-bearing account from which only OFAC-authorized debits may be made. See, 31 C.F.R. § 515.205(a). OFAC defines an interest bearing account as "a blocked account earning interest at no less than the maximum rate payable on the shortest time deposit in the domestic bank where the account is held: Provided however, That such an account may include six-month Treasury bills or insured certificates, with a maturity not exceeding six-months, appropriate to the amounts involved." 31 C.F.R. § 515.205(g).

If the phrase "interest-bearing account" raises a red flag for federal credit unions, it is because NCUA’s Truth in Savings rule prohibits federal credit unions from offering interest-bearing deposit (as defined in in the rule) and may instead offer dividend-bearing deposit accounts. See, 12 C.F.R. § 707, Supp. I, cmt. 707.2(i)-1. 

OFAC and other Treasury regulations are written in a bank-centric manner, so sometimes the language in these regulations have inadvertent construction issues. As there is no carve-out exception for federal credit unions in the section of the regulation that requires placing blocked funds in interest-bearing accounts, many credit unions have interpreted this requirement to mean a dividend-bearing account. To clarify this requirement, NAFCU contacted OFAC's compliance helpline and they agreed with the interpretation that depositing blocked property into dividend-bearing accounts would meet the requirement. However, it would be great to see this glitch clarified by NCUA or OFAC in actual guidance documents such as the NCUA AIRES Exam Questionnaire, OFAC FAQs, or the FFIEC BSA/AML Examination Manual so that federal credit unions could feel more comfortable relying on this interpretation.

As for whether the credit union has to create individual blocked property accounts or one account for all blocked property, OFAC does not have a preference as long as the credit union maintains an audit trail that allows it to determine specific ownership interest of blocked property. See, OFAC FAQs: Sanctions Compliance, Q.32.

Initial Report

Credit unions are also required to file a report of blocked property within 10 business days from the date that property becomes blocked. The report should detail the blocked property and also include information pertaining to payments or transfers that are rejected by the credit union because of a blocked program. See, 31 C.F.R. § 501.603(b)(1)(ii). In the initial report, the credit union must also certify that the blocked funds have been deposited into a blocked account. See, 12 C.F.R. § 501.603(b)(1)(ii).

To ensure all pertinent and required information is included in the initial report, credit unions can use the form provided by OFAC and electronically transmit it to: [email protected] or mail it to: Office of Foreign Assets Control, Compliance Programs Division, U.S. Treasury Department, 1500 Pennsylvania Avenue NW.—Annex, Washington, DC 20220. Credit unions should be aware that there is a separate form for rejected transactions that follows the requirements of section 501.604.

Annual Report

Finally, OFAC requires that credit unions provide a comprehensive list of all blocked property held as of June 30 of the current year by September 30. See, 31 C.F.R. § 501.603. The term blocked property only applies to property that is blocked pursuant to OFAC regulations and does not include property that has been unblocked by general or specific license even if it has not yet been returned to the owner. This means that if the credit union unblocked property on June 29th and returned this property by July 1st, it should not include information on the unblocked property in its annual report. However, note that the regulation also establishes record keeping requirements for all blocked transactions for a period of 5 years after the date of the transaction. See, 12 C.F.R. § 501.601.

The annual reports must be filed using Form TD F 90-22.50, Annual Report of Blocked Property and the form should be sent to [email protected]. In case of additional questions, OFAC recently updated its guidance on filling out the annual blocked property report. The guidance is especially helpful for credit unions with 20 or more blocked accounts as it allows for a spreadsheet instead of a PDF or word document to complete part B of the form.

There you have it— next time you get an OFAC hit subject to a blocking order, you hopefully won't have to go through the entire bank-centric regulation to figure out OFAC's requirements.

OFAC Enforcement: How is an Administrative Action Decided?

Written by Shari R. Pogach, Regulatory Paralegal, NCBSO

The general factors used in determining an administrative action for Office of Foreign Assets Control (OFAC) violations were discussed during its fall symposium held in December 2016, here in Washington, DC. There are 11 general factors that must be analyzed by OFAC.  These factors and the related underlying activity include:

1. Willful or reckless violation of law – willfulness; recklessness; concealment; pattern of conduct; prior notice; management involvement.
2. Awareness of conduct at issue – actual knowledge; reason to know; management involvement.
3. Harm to sanctions program objectives – economic or other benefit to the sanctioned individual, entity or country; implications for U.S. policy; license eligibility; humanitarian activity.
4. Individual characteristics – commercial sophistication; size of operations; financial condition; volume of transactions; sanctions history.
5. Compliance program – risk-based compliance; consultation with regulator.
6. Remedial response – an immediate stop to conduct; determine the cause of conduct and extent of apparent violation; new and more effective internal controls and procedures; prevent a recurrence.
7. Cooperation with OFAC – voluntary self-disclosure; similar transactions; response to requests for information; tolling agreement(s).
8. Timing of apparent violation in relation to imposition of sanctions – date of apparent violations in relation to the adoption of the applicable prohibition(s).
9. Other enforcement action – other federal, state or local agencies’ actions; comprehensive settlements with other agencies.
10. Future compliance/deterrence effect – to promote future compliance; focus on same sector.
11. Other relevant factors – case-by-case basis; totality of circumstances; proportionate response.

Substantial weight is given to factors A, B, C and D in making a determination as to whether an infraction is considered egregious.  There are statutory maximum penalties for OFAC violations but the amount of the base penalty can be adjusted to reflect any of the applicable general factors.   Each of the 11 general factors may also be considered mitigating or aggravating thus resulting in a lower or higher proposed penalty amount.  But the base or proposed penalty amount cannot exceed the statutory maximum amount. This slide presentation from the symposium provides an overview of OFAC enforcement along with a couple of case studies.

During fiscal year 2016, there were three cases involving financial institutions that resulted in OFAC issuing a Finding of Violation.  Earlier this year, OFAC announced its enforcement action against Toronto-Dominion Bank (TD Bank) with a settlement agreement and Finding of Violation for the bank’s violations of the Iranian and Cuban sanctions.  TD Bank is headquartered in Toronto, Canada, but the bank and its subsidiaries processed multiple prohibited transactions through the United States.  The enforcement action highlights the facts and circumstances in OFAC’s determination of its administration action. 

Symposium speakers noted that OFAC is stepping up its enforcement actions.  It was also emphasized that any information provided to OFAC must not be inaccurate, misleading or incomplete.  And, one speaker even said, “Don’t lie to OFAC as we take it personally.”

OFAC 2016 Fall Symposium: Round-Up of Recent Sanctions

By Stephanie Lyon, Regulatory Compliance Counsel

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) held its fall symposium in Washington DC, on Wednesday, December 7th. Among the items discussed in this meeting were the recent changes to the Iran and Cuba sanctions and the elimination of the Burma and Côte d'Ivoire sanctions. As the end of the year is approaching, this is the perfect time to highlight some of OFAC’s recent activities. For a comprehensive list of active OFAC sanctions, visit the Sanctions Programs and Country Information Resource Center. Guidance documents are constantly updated so remember to check back with OFAC for up-to-date information.

Iran Sanctions and JCPOA Announcement

Back in 2015, key nations reached a Joint Comprehensive Plan of Action (JCPOA) to ensure that Iran’s nuclear program was implemented with only peaceful intent. On January 16, 2016, the International Atomic Energy Agency (IAEA) verified Iran’s implementation of key nuclear-related measures specified in the JCPOA. Upon verification from the IAEA, the United States lifted nuclear-related sanctions on Iran. What does this mean for credit unions? The JCPOA provisions included removals of Specially Designated Nationals (SDNs) and Blocked Persons List, the Foreign Sanctions Evaders List and the Non-SDN Iran Sanctions Lists which hopefully translates to less false positives. For more information on Iran’s sanctions and the JCPOA, visit the Iran Sanctions Resource Center webpage.

Cuba Sanctions

In 2014, President Obama historically announced the re-establishment of diplomatic relations and an easing of economic and travel restrictions on Cuba. As more Americans are able to travel to Cuba, credit unions began asking a question not considered in 5 decades—whether a credit union can serve members while in Cuba. To assist financial institutions, OFAC published over 100 FAQs that were recently revised in October of this year. Here are a couple of questions pertaining to financial institutions answered in the FAQ guidance:

46. Are authorized travelers in Cuba permitted to use credit or debit cards issued by a U.S. financial institution?

Yes. Travelers are advised to check with their financial institution before traveling to Cuba to determine whether the institution has established the necessary mechanisms for its issued credit or debit cards to be used in Cuba. See 31 CFR § 515.560(c)(5) and 515.584(c).

[…]

61. Is a financial institution required to independently verify that an individual’s travel is authorized when processing Cuba travel-related transactions?

No. A financial institution may rely on U.S. travelers to provide their certifications of authorized travel directly to the person providing travel or carrier services when processing Cuba travel-related transactions, unless the financial institution knows or has reason to know that the travel is not authorized by a general or specific license.

The [Cuban Assets Control Regulations] (CACR) requires persons subject to U.S. jurisdiction providing travel or carrier services to retain for at least five years from the date of the transaction a certification from each customer indicating the section of the CACR that authorizes the person to travel to Cuba. See § 515.572(b). U.S. travelers utilizing a general or specific license are also required to retain for five years records associated with their travel to Cuba.

For more information, guidance and resources on the Cuban Assets Control Regulations, visit the Cuba Sanctions Resource Center.

Elimination of Côte d'Ivoire and of Burma Sanctions

Years ago, Burma and Côte d'Ivoire were plagued with national security, human rights and other internal issues that prompted the United States to enact sanctions against these countries.  After lengthy work by several international organizations both countries held successful presidential elections and moved towards the stabilization of their nations.  On September 14, 2016, after the United Nations Security Council determined Côte d'Ivoire’s emergency situation was resolved, President Obama ended the sanctions program against this nation. See, Côte d'Ivoire Sanctions Resource Center. Similarly, in October 7, 2016, the President signed an Executive Order terminating the emergency with respect to the actions and policies of Burma. See, Burma Sanctions Resource Center.

My favorite quote of Wednesday’s meeting occurred when a panelist discussing the recent elimination of OFAC sanctions simplified the conversation by stating:  “the sanctions for Burma and Côte d'Ivoire are over, let’s just move on.” For credit unions, this means these two countries can now participate in financial markets again which may mean an increase in wire transfers to and from these countries.

OFAC ProTips

Apart from the updates concerning sanctions there were other key takeaways from the symposium:

1. OFAC does not have a requirement that credit unions have a compliance program; rather it recommends a risk-based approach to OFAC compliance. Credit unions may want to keep in mind that regardless of its OFAC approach, if the credit union facilitates a prohibited transaction it will have an OFAC violation. Some resource credit unions may use when assessing an OFAC program are: 
   • NCUA Examiner’s Guide, Ch. 18 (OFAC specific guidance within Bank Secrecy Act section)
     
   • NCUA FCU Handbook, pp. 54-55 (lists NCUA expectations for OFAC compliance)
     
   • NCUA Letter to Credit Unions 05-CU-09 (NCUA acknowledged that while both BSA and OFAC compliance are integral to any anti-money laundering program)
     
   • NCUA Letter to Credit Unions 01-CU-25 (NCUA developed an examiner checklist that may be use to document the review of a credit union’s OFAC compliance program)
     
   • FFIEC BSA/AML Examination Manual, OFAC section & App. M. (OFAC core examination procedures and risk matrix)
2. When identifying names on the SDN or other lists, it may be necessary to search more than just OFAC provided information or resources. This is where the credit union’s risk assessment and subsequent due diligence is key in determining its policies and procedures.
3. If unsure, ask! OFAC has published many resources such as interpretative documents and FAQs to its sanctions programs. It also has an OFAC Compliance Hotline ready to assist. The speakers did emphasize the need for credit unions to provide as much detail as possible when submitting questions to the helpline, especially if the credit union wants to receive a timely response. You can find the contact information for the Hotline here.

***

Upcoming NAFCU Webcast

What's New in the updated FFIEC Cybersecurity Handbook

Live Webcast Tuesday, December 13, 2016 | 2:00-3:30 p.m. ET

• Explore governance of the Information Security Program, including security culture, responsibility and accountability, and resources
• Learn about Information Security Program management, including identification, measurement, mitigation and monitoring
• Discuss Security Operations such as identification, assessment, and threat monitoring
• Measure Information Security Program effectiveness
  

BSA/AML Compliance Requirements: Frequently Asked Questions This Week; NAFCU’s new BSA Seminar + Certification is Here!

Written by Shereefat Balogun, Regulatory Compliance Counsel

This week NAFCU hosted its annual Regulatory Compliance School, focusing on the most important regulatory compliance issues facing credit unions. Today’s session will cover the Bank Secrecy Act (BSA) and OFAC (Office of Foreign Assets Control) regulatory framework. However, attendees seemed all too anxious and could not wait to ask their BSA/AML related questions- and understandably so. With an increase in enforcement actions for BSA/AML violations, ongoing OFAC sanctions and impending rules on customer due diligence, credit unions, and other financial institutions, are working hard to keep up with their compliance requirements under the BSA/AML regime. Today’s “FAQs” were inspired by the many BSA/AML related questions and concerns raised throughout the week.

Q: Does a credit union have an obligation to reconcile conflicting identification information provided by a member? We have a member who recently filled out a change of address form, and the SSN he put down is completely different from the one he gave to open this account. Is there any responsibility on the credit union’s part to take any action concerning this discrepancy?

A: Yes, the credit union does have an obligation to address any discrepancies as it pertains to identifying information.  Generally, before opening an account for a customer, the credit union must be able to form a reasonable belief that it knows the true identity of the customer based on the information gathered. The conflicting information may have been made in error.  In any event, the CIP procedures must specify how the credit union will resolve the discrepancies.  If the information is indeed conflicting and can’t be reconciled, the credit union may have an obligation to file a SAR.

Each credit union must have a written CIP that allows it to form a reasonable belief that it knows the true identity of each customer.  The CIP must contain procedures for opening an account that specify the identifying information that will be obtained from each customer.  The credit union must obtain, at a minimum, the following four pieces of information from the customer prior to opening an account:

• Name
• DOB for individuals
• Address
• Identification Number

In addition to gathering the four pieces of information outlined above, the credit union is required to verify the identity of the customer using the information gathered.  In verifying the information, the credit union may use documents and/or non-documentary methods, if its CIP procedures allow for that.  If there are discrepancies in the information, this may create a challenge in the credit union’s ability to form a reasonable belief that it  knows the true identity of a member.  The CIP procedures should outline steps the credit union will take to properly, and more accurately, identify an individual.  The conflicting information may have been made in error.  In any event, the CIP procedures must specify how the credit union will resolve discrepancies using documents and/or non-documentary information.   This may include calling the member to address inconsistencies, relying on other sources such as public databases, or checking references with other banks and/or credit unions.  If the information is indeed conflicting and can’t be reconciled, the credit union may have an obligation to file a SAR. Also note that the credit union is well within their right to put the account on hold while it reconciles the information.

 

Q: Can a credit union accept a current passport instead of a taxpayer identification number or social security number at account opening?

A: Generally, credit unions must obtain an identification number before opening an account for a prospective member.  For US persons, this would be a taxpayer identification number.  For non-US persons, a current passport would suffice.  It appears, however, that a credit union may accept other forms of ID if its CIP procedures provide for that, especially where the customer has applied for a taxpayer identification number, but has not yet received one.  Generally, before opening an account for a customer, the credit union must be able to form a reasonable belief that it knows the true identity of the customer based on the information gathered. The relevant rules can be found in 31 CFR 1020.220.

Before opening an account for a customer, a credit union must collect identifying information, including an identification number.  For a U.S. person, this will be a taxpayer identification number.  For a non-U.S. person, one or more of the following will be acceptable: (i) a taxpayer identification number; (ii) passport number and country of issuance; (iii) alien identification card number; or (iv) number and country of issuance of any other government-issued document evidencing nationality or residence and bearing a photograph or similar safeguard.

The rule does make an exception for individuals who are applying for a taxpayer identification number.  According to the rule, a credit union’s CIP may include procedures for opening an account for someone who has applied, but not received a taxpayer identification number.  This may include accepting other forms of identification number, including a current passport.  However, the procedures must ensure that the individual obtains the taxpayer identification number within a reasonable period of time after the account is opened.

(B) Exception for persons applying for a taxpayer identification number. Instead of obtaining a taxpayer identification number from a customer prior to opening the account, the CIP may include procedures for opening an account for a customer that has applied for, but has not received, a taxpayer identification number. In this case, the CIP must include procedures to confirm that the application was filed before the customer opens the account and to obtain the taxpayer identification number within a reasonable period of time after the account is opened.  31 CFR 1020.220(a)(2)(i)(B)(emphasis added.).

Also, the rules provide credit unions with the ability to verify identification through non-documentary methods.  The credit union’s CIP must specify the situations where a credit union would use non-documentary methods to verify a customer’s identity and how to handle them, including when a customer doesn’t have all the necessary documents at the time he/she comes in to open the account.

 

Q: Is a credit union required to file a CTR where a member withdraws $9,500 in cash from a rep payee account and $700 from his personal account on the same day? 

A: The answer to your question can be found in Treasury’s BSA/AML regulations, 31 CFR 1010.  Yes, in this situation, the credit union is required to file a CTR because, although there were multiple transactions, the transactions: (i) resulted in a cash withdrawal in excess of $10k; (ii) occurred during the same business day; and (iii) were made by the same person.

31 CFR 1010.311 requires that a credit union report cash transactions in excess of $10,000 during the same business day. Indeed, the rule states:

Each financial institution other than a casino shall file a report of each deposit, withdrawal, exchange of currency or other payment or transfer, by, through, or to such financial institution which involves a transaction in currency of more than $10,000, except as otherwise provided in this section.  31 CFR 1010.311 (emphasis added.).

Moreover, the amount over $10,000 can be either in one transaction or a combination of cash transactions.  The credit union should treat the multiple transactions as a single transaction if the credit union knows that the transactions are by the same person. The rule provides:

(b) Multiple transactions. In the case of financial institutions other than casinos, for purposes of the transactions in currency reporting requirements in this chapter, multiple currency transactions shall be treated as a single transaction if the financial institution has knowledge that they are by or on behalf of any person and result in either cash in or cash out totaling more than $10,000 during any one business day (or in the case of the U.S. Postal Service, any one day). Deposits made at night or over a weekend or holiday shall be treated as if received on the next business day following the deposit.  31 CFR 1010.313 (b)(emphasis added.).

Here, although the first cash withdrawal of $9,500 was made from a rep payee account, and thus was not his own personal account and not his own personal funds, the aggregate amount withdrew on that day was in excess of $10,000 and was made by the same person.  The credit union was asked to give a single person more than $10,000 in cash on a single day. The fact that the transactions involved multiple, or different, accounts is irrelevant.  Accordingly, the credit union should file the CTR with FinCEN.

 

Q: What steps should a credit union take when it gets an “OFAC hit”?

A: OFAC’s (Office of Foreign Assets Control) regulations prohibit all US persons from engaging in transactions with certain specified persons and countries. Specifically, credit unions must: (i) block accounts and other assets of “Specifically Designated Nationals” (SDNs) and “Blocked Persons”; and (ii) block or reject prohibited transactions with SDNs and Blocked Persons.

Generally, if the credit union gets an “OFAC” hit, the credit union needs to confirm that the individual that was flagged is indeed the individual on the SDN list. Treasury has a hotline dedicated to providing assistance with making a determination if the person is the same. If the person or entity is indeed the same included on the SDN list, the credit union cannot open the account; but rather must block the transaction and account, and also report the blocked transaction/account to OFAC.

While not required by specific regulation, NCUA expects that a credit union will establish and maintain an effective, written OFAC compliance program commensurate with its OFAC risk profile. Amongst other things, the policies, procedures and processes should address how the credit union will identify and review transactions and accounts for possible OFAC violations. The policies and procedures should also define the credit union’s criteria for comparing names provided on the OFAC “SDN” list with the names in the credit union’s files or transactions and for identifying transactions or accounts involving sanctioned countries. Furthermore, the policies and procedures should address how the credit union will determine whether an initial OFAC hit is a valid match or a false hit.

 

Q: Where can I go for assistance in developing our BSA/AML risk-based model? The rules don’t say anything. I’ve checked the FFIEC BSA/AML examination manual and it doesn’t say much on how the risk based model program should look like.

A: Honestly, the guide or the rules will not go into that level of detail. Here’s the reason. Generally, governments around the world feel that the risk-based approach is preferable to a more prescriptive approach in the BSA/AML space because it is:

1. Flexible- AML/BSA risks vary across jurisdictions, customers and products; and
2. Effective- Credit unions are better equipped than legislators to effectively assess and mitigate specific BSA/AML risks they face.

Notwithstanding the lack of specific guidance, however, there are four main things a credit union’s risk assessment should consider:

1. Members- Who are you selling your products or offering services to? Individuals or private companies? Foreign public officials? Money Servicing Businesses?
2. Products and Services- What products and services are you offering that may be vulnerable to money laundering? Online banking? Private banking? Correspondent banking? Wire transfers?
3. Geographical Location- In what countries do your members reside and what are their countries of citizenship? Where are your corporate customers headquartered and where do they conduct their business? Are you engaging in transactions involved with countries included on any government lists?

Generally, some member types , products and services, and geographical locations pose higher risks than others, and thus your program wants to properly identify those and tailor its monitoring accordingly.

As indicated above, we received a substantial number of BSA/AML inquiries. Indeed, compliance with the BSA/AML rules remains a top priority for financial institutions. NAFCU is here to assist you as you navigate through the rules and will keep you abreast of emerging challenges, and regulatory developments. In fact, the industry is still awaiting FinCEN’s final rule on Customer Due Diligence and beneficial ownership requirements, which is expected this year. We will keep you posted.

###

NAFCU’s new BSA Seminar + Certification is Here!

We’ve had hundreds of requests from credit unions to provide more BSA training, and I’m excited to announce, it’s here. We’ll be holding our first in-person, BSA Seminar in New Orleans October 24 – 28. If those dates and location sound familiar to you, it’s not déjà vu. We’ll be running this BSA Seminar concurrently to our Regulatory Compliance Seminar. While they are two separate educational events, the networking aspects will be co-mingled, making it an awesome way to build your network of credit union and BSA professionals from around the country.

You can expect a full week of everything you’ve ever wanted to know about BSA, but didn’t have time to ask. It’s designed for just credit union professionals. You’ll find no erroneous “bank” information that doesn’t apply to credit unions. Check out the full agenda and sessions.

There’s an optional, pre-conference workshop to help get you up-to-speed on BSA fundamentals – it’s perfect if you’re new to BSA or just want a refresher. And at the end of the week, you’ll have the opportunity to get certified when you sit and pass the NAFCU Certified Bank Secrecy Officer (NCBSO) exam.

This seminar, and the certification, is an excellent way to demonstrate to NCUA and FinCEN you’re dedicated to compliance and to protecting your credit union against financial crime. It was designed by NAFCU’s Director of Education Devon Lyon, former director of BSA at State Department Federal Credit Union – so the curriculum is extremely relevant at both a strategic and tactical level. You’ll walk away ready to master your AML responsibilities. And of course, it fulfills your yearly BSA training requirement!

We have limited seating – so register early!

A Little BSA, A Little OFAC; January BSA Blast; Programming Note

Written by Shari R. Pogach, Regulatory Paralegal

Compliance with Bank Secrecy Act (BSA) and the Office of Foreign Assets Control (OFAC) requirements continues to be an issue for some financial institutions. Towards the end of 2015, the Board of Governors of the Federal Reserve System posted enforcement actions against three banks: The Bank of Nova Scotia of Toronto, Canada; East West Bank of Pasadena, California; and Habib Bank Limited of Karachi, Pakistan. Each bank had varying degrees of problems with its BSA and anti-money laundering (AML) compliance programs as well as OFAC compliance. All are now subject to monitoring, reporting and transaction lookback review as a result of the deficiencies. It is sometimes helpful to review what someone else has or is doing wrong to ensure your own compliance program is up to snuff.

Cuba and Iran Sanctions

We all know there have been significant changes announced to U.S. policy concerning Cuba and Iran. As a result, there have also been some changes to the OFAC requirements for both countries. I thought it might be help to post the following FAQs from OFAC on the changes:

Changes to the Cuba Sanctions - Frequently Asked Questions, and

Frequently Asked Questions Relating to the Lifting of Certain U.S. Sanctions Under the Joint Comprehensive Plan of Action (JCPOA) on Implementation Day.

***
BSA Blast: The January 2016 quarterly issue of the BSA Blast is now available (a NAFCU login required). This issue takes a look at the enforcement actions against Deutsche Bank AG for U.S. sanctions violations and reviews recent speeches made by the Financial Crimes Enforcement Network Director Jennifer Shasky Calvery. The issue also includes a new BSA quiz for staff training on OFAC reporting and record keeping requirements.
***
NAFCU Webcast: Register for this live webcast, Bank Bribery Issues from a Board Member’s Perspective, on Wednesday, January 27, from 2-3:30pm EST. The role of a credit union board member is more significant than ever. And, a director has the ultimate decision making authority and responsibility for controlling the direct operations of the credit union, which also means understanding the internal and external entities that affect decision making. Join us for an in-depth look at rules, regulations and best practices regarding bank bribery issues that every director needs to know. During the webcast, we will review examples and case studies of Bank Secrecy Act (BSA) violations, explore ethics rules and required policies for internal dealings, and more
***
Programming Note: Winter Storm Jonas is coming so NAFCU is closing at 12 noon today to ensure folks get home safely. But never fear, for those not impacted by Jonas, the Regulatory Compliance team will still be available to answer your questions remotely.

OFAC Enforcement Results in False Hits List Guidance; A Taste of Ireland

Written by Shari R. Pogach, Regulatory Paralegal

A recent enforcement action by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has resulted in the issuance of new guidance concerning false hits lists.  OFAC issued a Finding of Violation against BMO Harris Bank NA as the successor to Marshall and Ilsley Bank (M&I), in connection with M&I’s processing of six funds transfers totaling $67,357 in violation of the Iranian transactions and sanctions regulations. 

Apparently M&I’s customer was a company that specialized in carpets and the company name included the word “Persian” in its name.  The funds were to pay an outstanding balance to an entity in Iran for the purchase of Iranian-origin carpets.  The company had been a customer of M&I since 2009 when importing Iranian carpets was still allowed.  M&I had added the company to its “False Hit List” on May 29, 2009, after its OFAC interdiction software generated multiple alerts due to the word “Persian.”   But M&I never updated its procedures after importing Iranian-origin carpets was no longer allowed after September 29, 2010. 

OFAC understands the need for such lists to reduce the volume of OFAC-related matches that have been determined are false, but warns that it is important that policies and procedures are implemented and designed to review, evaluate and reassess the parties that are included on such lists. The False Hit Lists Guidance lists possible measures to be taken such as: 

• Involving sanctions compliance personnel in developing guidelines for, and oversight of, the functioning of false hit lists, including periodic reviews;
• In situations where additions or changes to an SDN List entry are similar to a false hit list entry, ensuring that alerts generated by screening hits in connection with the additions/ changes to the SDN List are not automatically suppressed by the existing false hit list entry;
• Amending the false hit list, as needed, in response to updates to OFAC’s sanctions programs (including, for example, the revocation of general licenses, the implementation of new sanctions programs and/or prohibitions, or enhanced restrictions on certain categories of transactions); and
• For direct customers who have an entry on a false hit list, ensuring that any meaningful changes to the customer’s information (e.g., a change in ownership status, business activity, address, date of birth, place of business, etc.) trigger a review of the false hit list entry. 

In other words, make sure if you create and use a false hit list, also make certain you have a policy and internal procedures in place to ensure that it doesn’t remain static. 

*** 

You may not realize from my name that I am Irish through and through – recently took a little trip to Dublin and Galway.  Ireland is full of red heads, music and Guinness!  Oh, and you might recognize my traveling companion in the last photo!

 
Dublin

 
Galway

 
Galway Buskers

 
Galway Pub

 
Dublin Fish and Chips 

HMDA—Institutional Coverage Test in 2017 and Beyond; BSA Blast Available

Written by Brandy Bruyere, Director of Regulatory Compliance

As Alicia mentioned on Friday, the CFPB finalized changes to HMDA on Thursday, October 15^th. Most of the rule such as new data points will not become effective until January 2018. However, the definition of “financial institution” is changing effective January 1, 2017 to incorporate one prong of the “institutional coverage” test, so I thought I would highlight that today and keep the blog short for a Monday morning.

Section 1003.2 contains a definition of financial institution that determines which credit unions must report under HMDA as applicable. Part (1) of this definition will have a fifth subpart added to include a threshold test so if a credit union does not meet another exclusion under the rule, it may still be exempt from reporting by not originating a threshold number of loans. Here is how this section of the rule will appear as of January 1, 2017:

“Financial institution means:

(1) A bank, savings association, or credit union that:

[…]

(v) In each of the two preceding calendar years, originated at least 25 home purchase loans, including refinancings of home purchase loans, that are not excluded from this part pursuant to § 1003.4(d)…”

See p. 653 of the final rule.

Meanwhile, the definition that becomes effective on January 1, 2018 will incorporate second prong which would also include those credit unions that originated at least 100 open-end lines of credit in each of the two preceding calendar years. Of course, the rule is written in a rather convoluted way, so as I continue to dig through more, I feel a bit like this:

 

Keep in mind that the final rule makes amendments to the official staff commentary as well, although none of these changes are effective until January 1, 2018. However, here’s the amended staff commentary to this particular test which does provide some clarification as to which loans count towards this threshold:

“5. Originations. Whether an institution is a financial institution depends in part on whether the institution originated at least 25 closed-end mortgage loans in each of the two preceding calendar years [January 1, 2017] or at least 100 open-end lines of credit [January 1, 2018] in each of the two preceding calendar years. Comments 4(a)-2 through -4 discuss whether activities with respect to a particular closed-end mortgage loan or open-end line of credit constitute an origination for purposes of § 1003.2(g).”

See p. 695 of the final rule.

(emphasis added)

NAFCU is working on a Final Regulation summarizing key parts of the rule that will be made available to members within a couple of weeks.

***

BSA Blast.   The October 2015 quarterly issue of the BSA Blast is now available for NAFCU members (member login needed).  This quarter, we review how the Department of Treasury’s Office of Foreign Assets Control’s final rule amending the Cuban sanctions changes things for financial institutions.  In addition, there is a new BSA quiz on Anti-Money Laundering compliance programs and Bank Secrecy Act reporting that can be used for staff training.

With Major Changes in U.S. Policy, Cuba Sanctions to Be Eased

Written by Shari R. Pogach, Regulatory Paralegal

One of the biggest news stories to hit the airwaves recently was that of President Obama’s announcement of major changes in U.S. policy with respect to Cuba.  The key elements of the executive actions to re-frame U.S. relations with Cuba concern: 1) re-establishing diplomatic relations, including re-establishing an embassy in Havana; 2) easing the regulatory hurdles to travel to Cuba; and 3) expanding and authorizing trade and financing.  Financial institutions can expect changes in two areas as a result of the policy changes, remittances and correspondent accounts. 

Remittances 

Remittance levels will be raised from $500 to $2,000 every three months for general remittances to Cuban nationals (excluding certain officials of the government or the Communist party). Remittance forwarders, as well as donations for humanitarian projects or private businesses, will no longer require a specific license. 

Correspondent Accounts  

U.S. financial institutions will be permitted to open correspondent accounts at Cuban financial institutions to facilitate the processing of authorized transactions. 

The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) has an entire webpage dedicated to Cuba sanctions with a number of resources including a reference brochure overview of Cuba sanctions.  OFAC has actually posted an FAQ concerning implementation of the policy change: 

“Q.  How will OFAC implement the changes to the Cuba sanctions program announced by the President on December 17, 2014?  Are the changes effective immediately? 

A.  OFAC will implement the Treasury-specific changes via amendments to its Cuban Assets Control Regulations. The Department of Commerce will implement the remainder of the changes via amendments to its Export Administration Regulations.  OFAC expects to issue its regulatory amendments in the coming weeks.  None of the announced changes takes effect until the new regulations are issued.” 

In addition, anyone looking for email updates on Cuba sanctions can sign-up here.

System Changes to Ease Compliance with OFAC Sanctions Regulations; NCUA Board Actions

Written by Shari R. Pogach, Regulatory Paralegal

Earlier this month, the Department of Treasury’s (Treasury) Office of Foreign Assets Control (OFAC) announced the consolidation of all of its non-Specially Designated National (SDN) lists into one set of data files now known as the “ Consolidated Sanctions List.”  The consolidated files comply with all of OFAC’s existing data standards and include all of the following lists:

Non-SDN Palestinian Legislative Council (NS-PLC),

Part 561,

Non-SDN Iran Sanctions Act (NS-ISA),

Foreign Sanctions Evaders, (FSE List), and

Sectoral Sanctions Identifications, (SSI).

The consolidation upgrade was done to reduce the number of list-related files needed to be downloaded so as to maintain an automated sanctions screening program. When appropriate, OFAC also will add any new data associated with any sanctions list created where the required action of a U.S. person does not necessarily entail blocking to the consolidated data files.  OFAC’s changes are meant to ensure that all of the sanctions list records are included in its Sanctions List Search tool.  This tool allows users to search for a name on the SDN lists and the consolidated list.

In approximately six months, OFAC will stop issuing independent files for the FSE, SSI and NS-PLC lists.  During this transition period OFAC will still produce the data both on the individual lists and the consolidated list.  And, OFAC will continue to provide and update .pdf and .txt versions of the FSE, SSI, NS-ISA, NS-PLC and Part 561 lists and their respective archive of changes files.  These file formats will continue to be available even after the transition period.

Additional administrative technical information concerning the non-SDN list data is also available in the Treasury announcement.  And, here are related FAQs for additional information on algorithms, scoring and other technical details regarding Sanctions List Search.​

***

​​​NCUA Board Actions. Yesterday, the NCUA Board issued two proposed rules.  The first would implement 2014 statutory changes to flood insurance measures affected by the Biggert-Waters Flood Insurance Act.  The second updates and technically revises the agency’s rules on corporate credit unions.  In addition, NCUA staff told the NCUA Board there will be no share insurance premium assessment for 2014.  There will soon be a NAFCU blog post breaking down the flood insurance proposal, so stay tuned!

 

Three Short Ones: NCUA Grants to Tornado Victims, AML Webinar, and Fair Lending Webcast.

Written by Eliott C. Ponte, Law Clerk

Grants to Help Credit Unions Affected by the Tornados

Low-income credit unions affected by the tornados in the South and Midwest can apply for emergency assistance grants to repair damages or replace equipment to restore services to members.  Low-income credit union can obtain more information about Urgent Needs Grants by clicking here, or can email the Office of Small Credit Union Initiatives at [email protected].

 

NCUA Hosts Free Webinar on AML

On Wednesday, May 21, 2014, at 2 p.m. EST, NCUA will be hosting the first of two free webinars titled: “How to Be in Compliance with OFAC and FinCEN.”  The webinars will provide an overview of OFAC’s and FinCEN’s programs, their enforcement authorities, and their relationships with other regulators. In addition, participants may receive a certificate of attendance if they individually participate in the survey offered during the webcast and take a short quiz at the end of the webcast.

Online registration is now open, and the link to the registration page can be found here.  Participants may also submit questions in advance to [email protected].

 

NAFCU Fair Lending Webcast: Best Practices and Indirect Auto Lending Issues

Receive important tips regarding how to optimize your fair lending compliance program, plus get updated on the headline-making indirect auto fair lending investigations and enforcement actions.  To find out more information regarding this webcast, click here.

Fuzzy Logic - OFAC's Improved SDN Search Tool

Written By JiJi Bahhur, Regulatory Compliance Counsel

OFAC has improved its SDN search tool by employing what it calls “fuzzy logic” on its name search field.  Fuzzy logic uses character, string, and phonetic matching when returning results from an SDN search.  The other fields on the tool use only character matching.

For those of you who don’t know what an SDN search is or what this improved tool would be used for, it is explained in the FAQs accompanied with the release of the improved tool.  Specifically, FAQ #9 reads:

“SDN Search is a free tool provided by OFAC to assist the public in complying with sanctions programs. It is intended to be used by individual users that are looking for potential matches on the SDN list. It should not be utilized by automated systems that are configured to continually run searches through the tool. For a copy of files that can be easily interpreted by automated systems and software programs, please see the list of XML, CSV, PIP, DEL, and FF files on the SDN page.”

The search tool and the FAQs on it can be found here.

If you’ve never used OFAC’s SDN search tool before, try it out.  I did!  And thankfully the whole compliance team here at NAFCU came out match-free!  Phew!   

NAFCU's Regulatory Compliance School Just Got Better - Regulatory Update Day

Written by Steve Van Beek

We've heard you!  For the past couple of years, we've received the following feedback about NAFCU's Regulatory Compliance School (paraphrased, of course):

"School is great and provided a solid foundation for understanding the regulatory requirements credit unions face on a daily basis.  BUT, the rules are changing so fast that it would be great to receive updates on what has just changed and what is changing next."

With this in mind, we've created Regulatory Update Day at NAFCU's 2013 Regulatory Compliance School (March 18-23 in National Harbor, Maryland).  

Regulatory Update Day (Thursday, March 21st) will provide:

• A clear understanding of what changes NCUA has in store for 2013 – including their Exam Focus

• An overview of the scope and applicability of the CFPB’s seven new mortgage regulations*

• A detailed look at the CFPB’s Qualified Mortgage/Ability-to-Repay requirements*

• Answers to Frequently Asked Questions on the mortgage rules from NAFCU’s compliance team*

• Insight from credit union attorneys and practitioners on how best to set up your implementation strategy

You can find more information on Regulatory Update Day here.  The three sessions with the "*" are sessions that are also part of NAFCU's Mortgage Reform Webcast Series.

The other 4 days of Compliance School will remain the same as will the opportunity to take the NAFCU Certified Compliance Officer (NCCO) exams.  Good luck!  

***

And, all attendees at NAFCU's 2013 Regulatory Compliance School will receive NAFCU's 2013 GPS (coming soon!) as well as NAFCU's Scope & Applicability Charts.

Remember:  You do not need to be a NAFCU member credit union to attend NAFCU's conferences or webcasts.  In fact, you don't even need to work at a credit union.  Each School usually features a handful of consultants, vendors and other credit union "peeps" who support credit unions - in one way or another - on a daily basis.      

***

CFPB Releases Semiannual Regulatory Agenda - Spring 2012; Seminar in Seattle

Written by Steve Van Beek

CFPB Regulatory Agenda.  Yesterday, the CFPB posted its Semiannual Regulatory Agenda - for spring 2012.  The previous Semiannual Regulatory Agenda was released in February 2012.  The latest release follows the same format and includes a listing of regulations in the various rulemaking stages: prerule stage, proposed rule stage, final rule stage, long-term actions and completed actions.  

Below is a listing of the various future regulations - organized by rulemaking stage.  Keep in mind the agenda is current as of April 13, 2012 and the CFPB has taken numerous actions since putting this agenda together.    

Prerule Stage:

• Registration of Certain Nonbank Covered Persons
• Supervision of Larger Depository Institutions and Affiliates
• Home Mortgage Disclosure Act (Regulation C)
• Requirements for Prepaid Cards (Regulation E) 

Proposed Stage:

• Amendments to TILA and FIRREA Concerning Appraisals
• Disclosure Rules and Substantive Protection for Certain High Cost Mortgage Loans (Regulation Z)** (proposed on July 9th)
• Mortgage Originator Standards (Regulation Z)
• Mortgage Servicing (Regulation X; Regulation Z)
• TILA/RESPA Mortgage Disclosure Integration (Regulation X; Regulation Z)** (proposed on July 9th)
• Credit Card Pre-Opening Account Fees (Regulation Z)
• Procedural Rule To Establish Supervisory Authority Over Certain Nonbank Covered Persons Based on Risk Determination
• Supervision of Certain Nonbank Covered Persons—Defining Larger Participants in Certain Consumer Financial Product and Service Markets (LP 2) 
• Copies of Appraisals or Other Valuations To Be Furnished by Creditor (Regulation B)

Final Rule Stage:

• Supervision of Certain Nonbank Covered Persons—Defining Larger Participants in Certain Consumer Financial Product and Service Markets (LP 1)** (finalized on July 16th)
• Disclosure of Records and Information
• State Official Notification Rule
• Rules Relating to Investigations
• Rules of Practice for Adjudication Proceedings
• Restatement of Federal Consumer Financial Law Regulations
• Requirements for Escrow Accounts (Regulation Z)
• TILA Ability to Repay (Regulation Z)
• Confidential Treatment of Privileged Information
• Disclosure Rules for Remittance Transactions (Regulation E)

Long-Term Actions:

• Alternative Mortgage Transaction Parity (Regulation D)
• Business Lending Data (Regulation B)
• TILA Mortgage Amendments (Regulation Z) 

Completed Actions: 

• Disclosure Rules for Remittance Transactions (Regulation E)

***

Only 27 potential rulemakings!!  The Regulatory Agenda also includes a short summary of each rulemaking that is useful for providing a quick overview of what will be covered by the rulemaking.  However, as last Monday's proposed rules show - a short summary doesn't do much when the proposals are 1099 pages and 293 pages.  

***

NAFCU's 2012 Regulatory Compliance Seminar.  Luckily, you don't have to read and understand all 27 potential rulemakings on your own.  We'll be covering quite a few of them at our 2012 Regulatory Compliance Seminar in Seattle, Washington - October 23-26.

The program-at-a-glance is available here (and we'll be including additional sessions as the proposals continue to flow).  We already have a session on the TILA/RESPA mortgage disclosures, the upcoming mortgage servicing proposal (including the periodic statement requirement) as well as a session on the remittances final rule.  Detailed session descriptions can be found here.

Remember - you do not need to be a NAFCU member to attend.  And, Save $100 if you Register by August 31st!

ATM Fee Update; Deadline for NCUA Grants; NAFCU Member Call-In; CU Podcast

Written by Steve Van Beek

Below are a couple of quick items for your Thursday.

ATM Fee Update.  Yesterday, the ATM Fee disclosure bill, H.R. 4367, passed the House Financial Services Committee and will now move on to the full House.  NAFCU is also urging the Senate to act on a similar bill, S. 3204.  

NCUA Grants.  Low-income credit unions have until tomorrow - June 29th - to apply for technical assistance grants and reduced-rate loans.  Remember, the grants can be used for staff, official and director training.  If you are a low-income credit union, be sure to review the application process soon.  

Archive of June 14 Call-In.  The archived version of NAFCU's mid-year Member Call-In is available online.  The live version was conducted on June 14th.  If you need to get caught up on the multitude of issues impacting credit unions, this is a good way to do so.   

Current Issues in Credit Unions.  I had the pleasure of being a guest on Episode 72 of the Current Issues in Credit Unions podcast.  We talked about the CFPB; CUSOs; OFAC; Twitter and a few other items that might be interest.

Additionally, NAFCU will be hosting a live taping of Current Issues in Credit Unions podcast from our Regulatory Compliance Seminar (October 23-26 in Seattle).  We hosted the first live podcast last year in Orlando (Episode 64) and we are very glad that Rob Rutkowski and Katherine Weber will be back live for the podcast in Seattle.     

Treasury OFAC Settlement with ING Bank; OFAC Compliance Programs

Written by Michael Coleman, Regulatory Compliance Counsel

Yesterday, June 12^th, 2012, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced a settlement with ING Bank N.V. (ING Bank) for potential violations of U.S. sanctions in the amount of $619 million, the largest OFAC settlement of any kind to date. The settlement resolves OFAC’s investigation into ING Bank’s intentional and systemic violation of U.S. sanctions. In light of this monumental settlement, I thought it might be useful to highlight some guidance on OFAC compliance programs.

OFAC’s Frequently Asked Questions directory contains a large number of useful Q&A’s concerning OFAC requirements.  If you have not visited the site before it is worth taking a look. Here is a Q&A from the directory concerning financial institutions’ OFAC compliance programs:

“25. Does OFAC itself require that banks set up a certain type of compliance program?

No. There is no single compliance program suitable for every financial institution. OFAC is not itself a bank regulator; its basic requirement is that financial institutions not violate the laws that it administers. Financial institutions should check with their regulators regarding the suitability of specific programs to their unique situations. [09-10-02]”

As the OFAC Q&A points out, there are no specific regulations requiring compliance with OFAC requirements. Rather, financial institutions, including credit unions, should look to their regulators for their OFAC compliance expectations. NCUA’s expectations regarding a credit union’s OFAC compliance program can be found in the Federal Financial Institutions Examination Council (FFIEC), BSA/AML Examination Manual. The FFIEC BSA/AML Examination Manual contains an OFAC Overview section which talks about OFAC compliance programs, it reads:

“OFAC Compliance Program

While not required by specific regulation, but as a matter of sound banking practice and in order to ensure compliance, banks should establish and maintain an effective, written OFAC compliance program commensurate with their OFAC risk profile (based on products, services, customers, and geographic locations). The program should identify higher-risk areas, provide for appropriate internal controls for screening and reporting, establish independent testing for compliance, designate a bank employee or employees as responsible for OFAC compliance, and create training programs for appropriate personnel in all relevant areas of the bank. A bank’s OFAC compliance program should be commensurate with its respective OFAC risk profile.” (emphasis added).

As the guidance indicates, a credit union’s OFAC compliance program is a risk based program in nature. The OFAC overview also contains a section on Internal Controls, and states that an effective OFAC compliance program should include the following internal control elements:

• Identifying and reviewing suspect transactions
• Updating OFAC lists
• Screening Automated Clearing House (ACH) transactions
• Reporting
• Maintaining license information

The FFIEC BSA/AML Examination Manual OFAC Overview provides a very good summary of NCUA’s expectations concerning OFAC compliance, I would suggest taking a look through it if you have not already. OFAC compliance is sure to continue to be a hot topic with NCUA in examinations, and as this U.S. Treasury settlement with ING Bank shows, non-compliance can be costly.  

***

NAFCU's BSA Webcast.  Now is the perfect time to get your annual BSA training.  Check our NAFCU's June 27th webcast: BSA for Compliance Experts.  Sign up by June 20 to Save $100!

Member Complaints; NAFCU's 2012 Regulatory Compliance Seminar

Written by Steve Van Beek

Consumer and member complaints are at the forefront of quite a few conversations right now (including quite a few news articles).  The CFPB's promotion of their complaint process is one reason for this uptick in discussion as is the centralized complaint process for financial products.  

The CFPB issued their 2011 Annual Report on Consumer Complaints and it is full of useful information to review.  Here is a snapshot of the results:

"Between July 21 and December 31, 2011 the CFPB received 13,210 consumer complaints, including 9,307 credit card complaints and 2,326 mortgage complaints.

Forty-four percent of all complaints were submitted through the CFPB's website and 14.7 percent via telephone calls.  Referrals from other regulators accounted for 34.9 percent of all complaints received.  The rest were submitted by mail, email, and fax."

Future reports will include even more details - including complaints in new areas such as private student loans, auto loans and checking accounts.  Be sure to review the full report or pass it along to the appropriate person at your credit union.   

NCUA.  The March 2012 edition of the NCUA Report also included an article on Trends in Member Complaints and Consumer Inquiries.  Of note, the article indicates that of the complaints received in 2011 less than 1 percent involved a consumer compliance violation.  Of that 1 percent, half of those were related to timing issues related to the error resolution process under Regulation E.  

***

NAFCU Regulatory Compliance Seminar.  October seems like a long way off but it will be here before you know it.  We are in the process of putting together the content and agenda - so please feel free to send in any comments, ideas or suggestions.  We love your input and this conference is really about you all so let us know what you need.

Here is what we are tentatively looking at so far (topics are subject to change, of course):

• TILA/RESPA Mortgage Disclosures
• Upcoming Mortgage Servicing Requirements
• The Latest on Overdraft Protection
• Remittance Transfers under Regulation E
• CUSOs
• Loan Participations
• Bank Secrecy Act Changes
• Social Media
• NCUA Update
• CFPB Update

I think that is a pretty good start - but let us know what you are looking for and how we can make NAFCU's 2012 Regulatory Compliance Seminar even better than the past.  

Recertification for NCCOs.  Remember, attending Regulatory Compliance Seminar is the best way to recertify your NAFCU Certified Compliance Officer (NCCO) designation.  Seminar offers 24 CEUs which is enough to fully recertify for two years.

Seattle, Washington.  Did I mention Seminar was in Seattle?  Right Downtown?  Well, now I have.  Hope to see you October 23-26, 2012!    

OFAC Search Tool; NCUA OSCUI Training; NAFCU Member Call-In

 Written by Sarah Zimmermann

• OFAC has announced the release of SDN Search. This is an online search tool that allows the user to search the SDN list. Of course OFAC maintains in the fine print that searches are conducted at the risk of the user and use of the tool does not constitute an official confirmation on its part of the existence (or nonexistence) of a match.

 

• NCUA's Office of Small Credit Union Initiatives (OSCUI) has announced its first free training video. OSCUI is planning a series of training videos, and this is the first in the series. This video is a bit of an overview of the role of the office within NCUA, and various programs that are available to small credit unions. The announcement details how credit unions may access the video, online or via DVD.

 

• NAFCU held its year-end member call-in yesterday. The call-in is free for members and is a great way to catch up on what NAFCU is up to. If you weren't able to tune in yesterday it will be available on the website in a few days. The call provided legislative, regulatory and economic updates, including a look ahead to what to expect in 2012. Topics included tax reform, Richard Cordray's CFPB nomination blocked by the Senate, MBL and data security legislation; the status and activities of NCUA and the CFPB; and Steve discussed a few hot compliance topics including member online authentication guidelines, ADA and ATMs, and NCUA's advertising rule.

 

• NAFCU members, our December Compliance Monitor is now available, and includes an article on free checking analysis.

 

CFPB; OFAC

Posted by Anthony Demangone

Does the CFPB even need a director?  Last week, I would have said that the answer to that question was quite clear. Today, I'm not so sure.

When U.S. Congressmen voted on the Dodd-Frank legislation regarding the CFPB, it was understood that the new agency would be run by a director that had to pass through the Senate confirmation process.  That was a very important concept, because those Congressmen who were on the fence about whether the new CFPB would have too much power could calm their fears knowing that the Director was subject to confirmation.  If a possible director had some flaw or had ideas that made too many Senators uncomfortable, that person would not be confirmed, or more likely - would not even be put forward into the confirmation process.

The naming of Elizabeth Warren as a Special Advisor to the President did ruffle some feathers, as that move seemed to run counter to the Dodd-Frank confirmation process. This trend has been exacerbated by recent news that the officials from Treasury Department  are confident that the CFPB can run just fine without a confirmed Director - even after the official transfer date has come and gone. Read more about this development here. (Bank Lawyer's Blog.) 

This development is a bit troubling.  Having a Senate-confirmed director is a well-designed example of "checks and balances."  Anyone who sat in Civics 101 can tell you that the fewer checks and balances you have, you'll see a greater likelihood for shenanigans.  Checks and balances: good.  Shenanigans: bad.  I know that a Director will eventually be named, but the longer the CFPB is allowed to function without one…well…shenanigans.  That’s all I can say.

***

OFAC.  OFAC has issued guidance on "Weak AKAs"  or "weak aliases."  If you look at the SDN list, you'll see that many entries have AKAs or "known aliases" included with the entry.  OFAC notes that many of these are "weak," as they'll trigger a few false positives.  OFAC is now noting which AKAs are weak. For example, in the .pdf version of the SDN list, weak AKAs are inside double quotations.   Here are some FAQs about weak AKAs:

Am I required to screen for weak aliases (AKAs)? 
OFAC’s regulations do not explicitly require any specific screening regime.  Financial institutions and others must make screening choices based on their circumstances and compliance approach.  As a general matter, though, OFAC does not expect that persons will screen for weak AKAs, but expects that such AKAs may be used to help determine whether a “hit” arising from other information is accurate. 

Will I be penalized for processing an unauthorized transaction involving a weak alias (AKA)?
A person who processes an unauthorized transaction involving an SDN has violated U.S. law and may be subject to an enforcement action.  Generally speaking, however, if (i) the only sanctions reference in the transaction is a weak AKA, (ii) the person involved in the processing had no other reason to know that the transaction involved an SDN or was otherwise in violation of U.S. law, and (iii) the person maintains a rigorous risk-based compliance program, OFAC will not issue a civil penalty against an individual or entity for processing such a transaction.

 

There's No Substitute for Reading; This and That

Posted by Anthony Demangone

As we look toward 2011, here's another thought. Read.  

A good compliance officer has to devote some time each day for reading.  The reading list might include new regulations, guidance documents, blog postings, newsletters, and the like.  Background reading is a must.  If you ignore it long enough, you'll eventually say things such as..."When did NCUA issue that?"  Hopefully not last year. 

Here are some thoughts along those lines:

• Turn off the phone, and shut your door.  Give yourself the right reading environment, or the time you spend reading may end up being time wasted.
• Perhaps one day a week, come in early.  I've found that I can accomplish more between the hours of 6 and 9 a.m. than I can the rest of the day. 
• If something is interesting, but not time sensitive, add it to a reading list or pile.  When time presents itself, which may be in 2014, pick up the pile and start digging through it. 

I don't think you'll ever have enough hours in the day to read everything that you want, but the more time and effort you can devote to this task, the better off you'll be. 

***

Here are some other items of interest:

OFAC.  They recently issued civil money penalties against two financial institutions. 

Regulation Z.  Last week the Fed issued an interim final rule to clarify a few issues regarding another recent interim final rule regarding MDIA requirements. 

Interchange.  Hey NAFCU members, we've created an overview of the Fed's recent proposal concerning debit card interchange fees.  

Things I Think that I Think

Posted by Anthony Demangone

Here are seven things that I think that I think.  But I'm not completely sure yet...

1. I think the days of lazy summers for compliance officers are over, if they ever existed.  People like to hold on to myths, and I think this is one of them.  
2. I think we should all be nice to anyone responsible for mortgage compliance issues. 
3. I think we should impose a page limitation on proposed regulations. If you can't get it done in 200 pages, perhaps the document is a wee bit complicated for general consumption.
4. I think that regulators expect a lot when they issue five rule-makings in one day.  It is hard to comply with things when there isn't enough time in the day to read proposals, let alone analyze them. 
5. Now that I think about it, I think there should be an issue limit on top of the "page limit" for regulators.  It is impossible for organizations to comply with scores of new laws, regulations and guidance documents when they are issued on top of each other.  I wonder what our world would be like if each regulator was only allowed to issue five major rule-makings or guidance documents each year? 
6. I think regulators should point to existing guidance documents first whenever possible, rather than creating new documents.  If existing guidance is adequate, enforce it. 
7. I think that's enough thinking for today.

***

Here are a few items of interest.

Regulation and the cost of credit.  We warned folks that added layers of consumer protection and regulatory restrictions would drive up the cost of credit.  It looks like we may be right.  Your honor, I'd like to enter into evidence Exhibits One (CNN.com) and Two (WSJ.com).

OFAC.  A bank has paid roughly $92,000 to settle claims of OFAC violations. The original fine was more than $200,000, but the bank self-reported the violation.  I'm seeing an up-tick of OFAC violations.  It is hard to know whether this is a general trend or whether the issues were specific to the affected financial institutions.  In any event, it is something to track.

Reg Z.  The Fed issued Consumer Affairs letter CA 10-10 to announce bank examiner procedures for the August 22, 2010 Reg Z changes. 

This and That

Posted by Anthony Demangone

We'll get back to Regulation CC tomorrow.  Today, I'd like to share some items that have been getting dusty in my e-mail in-box.

• The Fed makes it official regarding the completion of the check processing restructuring.
• Have you seen the Ally Bank "pony" ad?  Cute and funny, right? Well, perhaps not for everyone. Read ICBA's take on this.  They were outraged that Ally implied that most banks are unethical and misleading.  Their letter is a strong reminder that other people see your advertisements.  Before you throw a competitor or a class of institutions under the bus in an advertisement, make sure you understand the risks.
• OFAC released its Annual Terrorist Assets Report.  It is a fairly interesting read, and it shows just how much has been blocked.  The charts/data could come in handy if you had to make an OFAC training presentation to staff.
• FEMA issued this letter last week to give folks a heads up that Congress was close to letting the National Flood Insurance Program lapse. (It has now officially lapsed, although action may be taken soon to fix the problem.) The letter includes a link to "guidelines" that FEMA created to address what happens in such "lapse" situations. 

• Rob Rutkowsi has put together a "best of issue" for the Current Issues in Credit Unions podcast.

A Little of This, A Little of That

This week, Representative Barney Frank introduced two bills that would ease burdens on financial institutions in the area of internet gambling.  Read all about it here.  I thought you might like to read about efforts to take stuff off of our plates.

***

You may have heard FDIC Chairman Sheila Bair talk about the creation of a national systemic risk council.  NCUA Chairman Fryzel isn't against the idea, as long as NCUA keeps its independence.

***

Hey NAFCU members: We put together a contact sheet to help you reach us.  It contains all the relevant email addresses and phone numbers.   Download Contacting NAFCU Compliance.  It also contains advice to ensure you get what you need.  Enjoy, enjoy!

***

I love FAQ's.  Especially OFAC's.  For example, what do you do when someone who is on the SDN list tries to open an account at your credit union?  Check out the answer.

***

Mandy and I celebrate our first anniversary this weekend.  Holy cow!  What a difference a year can make.

Here are five random things I learned this year:

1. "Absolutely!" is the best answer to any question from your spouse. 
2. Children are a blessing.  An expensive, sleep-depriving blessing.
3. Life can exist without a daily dose of ESPN.
4. I should buy stock in any company that makes diapers or baby formula.
5. I never thought getting someone else to burp would play such a major part in my day.

  For all you moms, Happy Mother's Day!  Enjoy your weekend, stay safe, and stay compliant.

Mortgage Fraud; OFAC Guidance

Yesterday, FinCEN released its latest mortgage fraud analysis.  In short, SARs filed on suspected mortgage fraud increased 44 percent in the 12 months ending in June 2008.

(Great.  More bad news.  One of these days, NBC news will lead with this shocker: Today, no depressing, dismal news to report. Now, on to Sports.  Unfortunately, today is not that day.)

Access the FinCEN report here.  If your credit union does mortgage lending, this would be a good read.

***

OFAC has issued an FAQ regarding financial institutions' obligations with regard to property that is owned, directly or indirectly, 50% or more by persons whose property and property interests in property are blocked pursuant to an Executive Order or regulations administered by OFAC.  Access it here.

 

Frequently Asked Questions; delicious

Anthony has mentioned the value of Frequently-Asked-Questions documents in past blog postings here and here.  These documents can help compliance officers weave through convoluted regulations and find answers to common issues.  Here are a few that I've found useful in the past: 

Bank Secrecy Act

Anti-Money Laundering Compliance FAQs

FinCEN Answers to FAQs on BSA

FAQs on Final CIP Rule - February 2004

FAQs on Final CIP Rule - May 2005

FAQs Relating to BSA and Hurricane Katrina

OFAC

OFAC Q&As Prepared by Treasury

Privacy

FAQs on the Privacy Regulation

Share Insurance

FAQs from NCUA's October 7, 2008 Webinar on Share Insurance Changes

NCUA's FAQs on NCUSIF and Share Insurance

HMDA

FAQs on Regulation C (HMDA Reporting)

RESPA

FAQs on RESPA for Industry

Appraisals

FAQs on Appraisal Regulation and Interagency Statement*

*Note:  The Agencies recently announced a proposal to replace this interagency statement.

Third Party Due Diligence

FAQs from NCUA's January 29, 2008 Webinar on Third-Party Relationships

Flood Insurance

2008 Proposal on Interagency Q&As on Flood Insurance (would replace 1997 Q&As)

1997 Interagency Q&As on Flood Insurance

Servicemembers Civil Relief Act (SCRA)

HUD's Q&As for Lenders Regarding SCRA

Judge's Guide to SCRA - including Q&As

Health Savings Accounts

Q&As on Health Savings Accounts - IRS Notice 2004-50

Q&As on Health Savings Accounts - IRS Notice 2008-59

Check 21 Act

Consumers FAQs on Check 21

FAQs for Financial Institutions on Check 21

Check 21 FAQs on Financial Institutions Requirements - from ABA

Accounting for Loan and Lease Losses (ALLL)

Questions and Answers on Accounting for Loan and Lease Losses

Online Banking

FFIEC Guidance on Authentication in an Internet Banking Environment

Savings Bonds

FAQs on Savings Bonds

***

You never know when these FAQ's will come in handy.  That is why I have mine bookmarked on my delicious page.

If you are wondering what delicious is, take a look at the user guide and slides I prepared for a talk on Organizing the Compliance Information Flow at NAFCU's 2008 Regulatory Seminar.

If you know of other valuable FAQ documents, please let us know by adding a comment to this post. 

OFAC Issues New Enforcement Guidelines

On Monday, OFAC published new enforcement guidelines in the federal register.  You can access them here.  These guidelines supersede earlier enforcement guidelines issued in 2003 and 2006.  The are effective immediately.

In short, OFAC wanted to share the process it navigates when it decides whether to punish an entity for OFAC violations, or whether to do anything at all.  From my reading, these guidelines are designed to reward institutions with strong OFAC compliance programs, and especially those that voluntarily disclose the violation to OFAC.  Conversely, those violations that are deemed to be reckless, willful, etc., will be treated more harshly.  An egregious case (yes, that's defined) where there was no voluntary self-disclosure could end up with a $250,000 penalty.

If you are in charge of your credit union's OFAC program, this is a must read. 

Here are some other OFAC resources:

• Other blog postings on OFAC.
• The BSA Manual's OFAC Chapter.
• OFAC's Official FAQ (Treasure Trove!)

Great OFAC/BSA Resources

I received a great email the other day from one of my compliance colleagues.  She shared with me the following resources that can help you identify high-risk jurisdictions:

1)      Countries subject to OFAC sanctions, including state sponsors of terrorism.

2)      Countries identified as supporting international terrorism under section 6(j) of the Export Administration Act of 1979, as determined by the Secretary of State.

3)     Jurisdictions determined to be "of primary money laundering concern" by the Secretary of the Treasury, and jurisdictions subject to special measures imposed by the Secretary of the Treasury, through FinCEN, pursuant to section 311 of the Patriot Act.

4)      Jurisdictions or countries identified as non-cooperative by the Financial Action Task Force on Money Laundering (FATF).

5)      Major money laundering countries and jurisdictions identified in the U.S. Department of State's annual International Narcotics Control Strategy Report (INCSR), in particular, countries which are identified as jurisdictions of primary concern.

6)   Offshore financial centers (OFCs) as identified by the U.S. Department of State.
    

Enjoy, enjoy!  (Note, you may need to poke around these websites a bit to find all that you need.  But they seem to be treasure troves of anti-money laundering information!)

OFAC and Dollar Thresholds

I'd be curious to know how many credit unions use dollar thresholds in their OFAC compliance program.  Dollar thresholds seem to be a logical way to build risk-based internal controls that control OFAC-related risk. 

For example, if a member wants to get a cashier's check for $1, would you check the name of a non-member payee against the OFAC SDN list?   What if the check was for $10?  Or $100?  or $1,000?  If I am allowed to build risk-based policies and procedures, it might seem reasonable to limit SDN reviews to items above a certain threshold.  And the 2007 BSA/AML Examiner's Manual indicates that it is every credit union's duty to build risk-based policies and procedures, based on their risk profile.   Here's the Manual's OFAC Chapter.  That being said, I am not aware that any regulator has publicly blessed the threshold system.

And OFAC is quick to point out that their requirements apply to every transaction, regardless of dollar amount. Here's their Q and A that addresses this issue.  And just to add to the puzzle, in 2006, OFAC released these enforcement guidelines. (Note that OFAC retains enforcement authority for its regulatory regime.) The guidelines seem to imply that should OFAC see a violation of its rules, it will review the strength of the institution's compliance program before it decides whether to start an enforcement action.

One more thought: does one want to risk their reputation by showing up in an OFAC enforcement action? 

At the end of the day, compliance officers are left in the middle.  When they look to the right, they see the strict liability of OFAC requirements.  When they look to the left, they see their ability to craft risk-based policies and procedures.  It isn't a fun place to be.

I wish I had an easy answer on this one.  Feel free to weigh in.

The Power of the SDN List

If you ever wondered how powerful the OFAC SDN List is, all you had to do is read a Treasury Press Release issued earlier this week.

The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) today removed from its list of Specially Designated Narcotics Traffickers 60 individuals who, since their designation, have severed ties with Colombia's notorious Cali drug cartel and are assisting Colombian authorities. All 60 individuals are Colombian employees of Copservir, a previously-designated enterprise that operated a retail drugstore chain before the Colombian government seized control of its operations in September 2004.

"Removing the names of these Copservir employees from the list of Specially Designated Narcotics Traffickers is the result of close cooperation with the Colombian government," said OFAC Director Adam J. Szubin. "Today's action represents a success in OFAC's targeting of Colombian drug cartels, as these 60 individuals have cut ties with the Rodriguez Orejuela narcotics trafficking organization and have instead cooperated with the Colombian authorities during the forfeiture process."

You can access the press release here. As you can see, no one wants to be on this list.  It has the effect of helping individuals decide to cooperate with law enforcement.  In 2007, OFAC published this study which showed the impact of its sanctions on the drug cartels.  (Please note: the study is almost 18 MBs in size!)  If you have time, this study does a good job of showing the isolation effect of appearing on the SDN list. In one situation, authorities placed a soccer team, which was owned by a suspect, on the list.

(I)n November 2006, within 72 hours of the designation of the soccer team Cortulua, the team’s president and three of its five board members resigned, sponsors withdrew their support, and key business partners publicly announced the severing of all commercial ties with the team.

Amazing.  Can you imagine this bar conversation?

Fan #1:  Man, my team really stinks right now.  We just can't score goals, and our defense is terrible.
Fan #2:  Stop complaining.  My team was just placed on the SDN list. 
Fan #1:  Ouch.

Read other OFAC related blog entries here.

OFAC Decision Tree; Risk-Based Pricing Notice; Thank you

When a credit union gets an "OFAC hit," the following question quickly surfaces: Now what??!!

OFAC, in its frequently asked questions section, explains what you should do to determine if you have a valid "OFAC Match."  You can access it here.  The guidance does a good job of methodically laying out what you should do, step-by-step.  Access other OFAC postings here.

News flash: Yesterday the Federal Reserve and the FTC issued the long-awaited proposal concerning risk-based pricing notices.  You can access a press release (which will give you access to the proposal) here.  Once it is published in the Federal Register, we'll have 90 days to comment.   I haven't had a chance to read through it. In fact, as I type this, I'm waiting for She Who Must Be Obeyed to finish packing before we head down to Syria, Virginia for our wedding!

***

Tomorrow is the big day, when I marry the love of my life.  Thanks to all of you who have wished me well and offered kind words of advice and congratulations.  The best part of my job is my interaction with all of you.  Again, thank you.  (And thank you for putting up with all of my wedding-related rants and ravings!)

Have a wonderful weekend, everyone!

Free Searchable OFAC SDN Website

One of my countless compliance discussion groups turned up a potential gem.  What if I told you that there is a a website that provides a free, searchable OFAC SDN List database.  That's right.  Free.  Would you believe me?  You should.

Access the website here.

Please check the disclaimer for the website, which you may access here.   The website is not affiliated with the U.S. Treasury Department, or any other government agency.   Information retrieved from searches conducted on the website contains information made available from directly within the public domain of OFAC and is not altered.  OFAC and NCUA have not endorsed the product. 

That being said, credit unions should take a look at the website to see if using it makes sense.  And you can't beat the price.

(By the way, I checked my name and Osama Bin Laden's on the site.  One one gave a hit.  Thank goodness.)

OFAC Scanning Suggestion; SAR Timelines

I helped present a webcast yesterday.  Here's a tip from a viewer that is worth sharing.

"I wanted to make a suggestion to credit unions regarding OFAC scans and was thinking maybe you could help share it.  So many CUs ask about how often they should scan their members, or even their vendor lists.  My suggestion to everyone is to scan your membership (and other lists) when the lists change, not necessarily on a specific, periodic basis.  For example, yesterday the terrorists lists were updated.  This morning, I scanned our membership and vendor lists after ensuring our scanning software had been updated.  Obviously transactions need scanned much more promptly."

That seems to be a sound, risk-based procedure. 

***

Also, I made a whoopsy-daisy during yesterday's webcast.  The time line for filing a SAR is as follows:

"The SAR rules require that a SAR be filed no later than 30 calendar days from the date of the initial  detection of facts that may constitute a basis for filing a SAR. If no suspect can be identified, the time period for filing a SAR is extended to 60 days." 2007 FFIEC BSA/AML Examination Manual.

Apologies for the slip-up!