Over the last 30 years, the emphasis of the Bank Secrecy Act has migrated from a sole focus on currency transaction reporting to a more comprehensive approach to monitor and detect suspicious activity.  The Bank Secrecy Act (BSA), originally passed in 1970, generally required the filing of currency transaction reports (CTRs) related to cash transactions greater than $10,000 and the recording of cash sales of monetary instruments greater than $3,000. Anti-money laundering (AML) regulation passed in the late 1980’s and early 1990’s expected financial institutions to monitor, detect and report to the US Treasury any suspected money laundering via suspicious activity reports.  The terrorist events of 2001 caused another significant change to the BSA/AML compliance spectrum by requiring customer identification procedures and enhanced due diligence procedures of banking customers.  In addition, the banking regulators have placed an increased emphasis on the detection systems used by financial institutions to monitor suspicious activity.  Every area of the bank should have systems in place to monitor for unusual transactions – loans, deposits, wire transfers, electronic banking, trust activities, etc.

Today, financial institutions must maintain a comprehensive BSA/AML compliance program.  This program must be written and approved by the board of directors.   Policy statements alone are not sufficient; practices must coincide with the bank’s written policies, procedures, and processes.  The BSA/AML compliance program must provide for the following minimum requirements:

• A documented BSA/AML risk assessment.
  
• A system of internal controls to ensure ongoing compliance, including CTR completion, exemption filing & review, suspicious activity monitoring, suspicious activity reporting, OFAC monitoring, high-risk entity identification & due diligence, and information sharing. 
  
• Independent testing of the BSA/AML compliance program. 
  
• Designate an individual or individuals responsible for managing BSA compliance (BSA compliance officer). 
  
• Training for personnel with training tailored to specific job responsibilities. 
  
• A comprehensive Customer Identification Program.

Annual independent testing of the BSA/AML compliance program by qualified independent parties is required by the regulation.  Independent testing should, at a minimum, include:

• An evaluation of the overall effectiveness of the BSA/AML compliance program, including policies, procedures, and processes. 
  
• A review of the bank’s BSA/AML risk assessment for reasonableness given the bank’s risk profile (products, services, customers, and geographic locations).
  
• Appropriate risk-based transaction testing to verify the bank’s adherence to the BSA recordkeeping and reporting requirements (e.g., CIP, SARs, CTRs and CTR exemptions, and information sharing requests). 
  
• An evaluation of management’s efforts to resolve violations and deficiencies noted in previous audits and regulatory examinations, including progress in addressing outstanding supervisory actions, if applicable. 
  
• A review of staff training for adequacy and comprehensiveness. 
  
• A review of the effectiveness of the suspicious activity monitoring systems used for BSA/AML compliance.  Related reports may include, but are not limited to:
  
• Suspicious activity monitoring reports. 
  
• Large currency aggregation reports. 
  
• Monetary instrument records. 
  
• Funds transfer records. 
  
• Nonsufficient funds (NSF) reports. 
  
• Large balance fluctuation reports. 
  
• Account relationship reports. 
  
• An assessment of the process for identifying and reporting suspicious activity, including:
  
• A review of filed or prepared SARs to determine their accuracy, timeliness, completeness, and effectiveness of the bank’s policy.
  
• A review of high-risk entity identification and monitoring—Money Service businesses and Politically Exposed Persons.
  
• A review of the bank’s OFAC compliance processes.

For further information on Bank Secrecy Act or anti-money laundering best practices or assistance with independent testing of your BSA/AML compliance program, please contact Tom Strause or Debbi Fetter with Financial Outsourcing Solutions, our internal audit & compliance outsourcing group.