AML Compliance Findings & Observations Wyn Clark U.S. Treasury

Summary Suspicious and Unusual Findings Transaction Activity Business and Account Structures Client Vetting Results High Risk Clients AML Program Reporting and Recordkeeping Risk Assessments Risk Based Program KYC Process Staffing Levels and Experience AML Compliance Integration into Business Units Transaction Monitoring Training Testing and Audit

Transaction Activity Suspicious activity?: Structuring to avoid reporting requirements or detection Rapid movement of funds Transactions out of context with client’s “expected” activity Unexplained complexity No clear economic purpose Domestic clients performing international transactions Transactions involving high risk countries

Business and Account Structures Business or Entity Lack of transparency Beneficial ownership Overly complex or difficult to understand Special purpose vehicles or entities Foreign Business Entities International Business Corporations Private Investment Companies Bearer shares Shell company or bank Nominees Account Unexplained accountholders and transactors

Client Vetting Results Items that may cause concern Unverified or inconsistent ID data points Incomplete bank data or files Negative news search findings Legal issues Court filings, arrests, warrants, convictions Established clients vs. walk-ins High risk clients and geographies

High Risk Clients Who are the bank’s high risk clients ? How are they flagged? (Manual vs. system) New account approval Risk Ratings Impact on monitoring Periodic reviews

Reporting and Recordkeeping Are the basics being done correctly? CTRs SARs KYC Data Stated vs. Actual Account Purpose and Use Law Enforcement Inquiries and Subpoenas Transactional History Investigations

Risk Assessment Does the bank fully understand its business, clients, products, and the associated AML risks? Assessment process: 1. Identify 2. Quantify 3. Mitigate 4. Residual Risk assessment drives AML Program Documented and supported Independently reviewed and authenticated Frequency appropriate

Risk Based Program Bank managing to its risks, not its resources Internal Controls AML staff Training Audit and testing Transaction monitoring KYC and on-boarding Bank staying current on the ever-changing trends in money laundering Bank’s AML risks changing, is the AML program keeping up? Clients, products and services, geographies, transactions BUDGET!!!!

Risk Based Program Risk Assessment Link to the BSA/AML Compliance Program – FFIEC Manual Identify & Measure Risk: Products Services Customers Geographic locations Transactions Risk Assessment Internal Controls Develop Applicable: Policies Procedures Systems Controls Result Risk-Based BSA Compliance Program Internal controls Audit BSA Compliance Officer Training Repeat Process

KYC Process How far does the on-boarding process go beyond verifying basic information? Source of funds Source of wealth Purpose of account RISK RATINGS? Expected transactions and account activity Is there connectivity between KYC (operations) and AML Compliance

Staffing Levels and Experience Key areas to consider: Seniority Reporting lines Experience and knowledge Size of staff Ongoing training Roles and responsibilities

AML Compliance Integration into Lines of Business Is AML Compliance keeping pace with changes at bank? New products and services Trade Finance, correspondent banking, mortgage financing Expansion into new markets – domestic vs. international New client types Acquisitions Volumes and complexities AML Compliance responsibilities throughout entire bank utilizing eyes and ears of all employees Employee referral process AML related communication to firm Reminders, new laws and regs, policy and procedural changes

Transaction Monitoring Transaction monitoring appropriate for transaction types or volume levels Alert scenarios or report parameters consistent with actual transaction activity Transactions compared to client or business type expected activity All activity is being captured Wires, checks, ATMs, journal entries Monitoring Independently verified Thresholds, scenarios

Transaction Monitoring Review of closed alerts or exception reports by independent party Risk based Transaction monitoring generating meaningful SARs Changes to monitoring adequately documented and tested Who approved, what was changed, when changed, why was change made Verification/testing of accuracy of information used in monitoring Aged client data, human input errors, computer coding errors Utilizing off-the-shelf systems and scenarios that aren’t appropriate for the bank

Training Primary Considerations: Content is risk based Targeted to specific employees, functions Frequency Content refreshed or updated periodically Receives independent review Senior management and Board of Directors Consequences for failure to take training

Independent Testing & Audit Key Considerations: Level of Independence Scope is risk based Staff knowledge Use of Sampling where necessary Ongoing oversight of AML Compliance changes at bank Follow-up on corrective measures Documented audit plan and procedures

Questions?.