Independent Banker - April 2023 - 23

Next: Differentiate your job post 
to be conducted by bank personnel
or by an outside party
¡ Designation of an individual
or individuals responsible for
coordinating and monitoring
day-to-day compliance (BSA
compliance officer)
¡ Training for appropriate personnel
FinCEN issued a final rule in
2016 that imposed requirements for
identifying and verifying beneficial
owners of legal-entity customers. It
requires risk-based procedures for
conducting ongoing customer due
diligence (CDD), to include, but not be
limited to, understanding the nature
and purpose of customer relationships
for the purpose of developing a
customer risk profile, conducting
ongoing monitoring to identify and
report suspicious transactions and, on
a risk basis, to maintain and update
customer information.
This rule was mandatory for all
federally insured financial institutions
by May 11, 2018. It added a fifth
core element to the original four core
elements of an effective BSA/AML
compliance program.
Trust but verify
Data collection, employee training,
documentation of transactions and
compliance recordkeeping may all
be in place and look cohesive and
robust at a community bank, but
without periodic independent testing
and verification, the other elements
of the BSA/AML program may
prove meaningless.
Let's look at the BSA/AML
program and the importance of
independent reviews. According to
the Federal Financial Institutions
Examination Council (FFIEC) BSA/
AML InfoBase, " The purpose of
independent testing (audit) is to
assess the bank's compliance with BSA
regulatory requirements, relative to
While the rules allow financial institutions
to engage independent reviews by inside
or outside auditors, consultants or other
parties, it is incumbent upon the bank to
conduct due diligence.
its risk profile, and assess the overall
adequacy of the BSA/AML compliance
program. Independent testing
should be conducted by the internal
audit department, outside auditors,
consultants, or other qualified
independent parties. "
Regardless of the party selected,
the auditor/reviewer must be truly
independent, not involved in the
creation or implementation of any
of the functions being tested, and
should report directly to the bank's
board of directors or a boarddesignated
committee.
While the rules allow financial
institutions to engage independent
reviews by inside or outside auditors,
consultants or other parties, it is
incumbent upon the bank to conduct
due diligence. It should determine:
¡ The sufficiency of the party's subject
matter expertise and qualifications
to conduct the independent BSA/
AML review
¡ The scope and sufficiency of any
contract, engagement letter, or
procedures covering such a review
¡ A clear framework for the process
the independent party will follow,
including availability of associated
workpapers for examiners,
communication with bank staff,
and method and frequency of
reports to senior management
and the board of directors.
The frequency of the BSA/AML
independent review is not mandated
by regulation. However, when the
bank plans for an independent
review, the frequency should be
commensurate with its risk profile
for money laundering or terrorist
funding activities; complexity of
operations; and significant changes
in the bank's risk profile, systems,
compliance staff or processes.
More frequent independent testing
should be considered when errors or
deficiencies in some aspects of the
BSA/AML compliance program have
been identified or to verify or validate
mitigating or remedial actions.
While creation of the BSA/AML
program is critical to the bank's
compliance with laws and regulations,
a well-planned, properly structured
independent review is essential
to effective risk management and
internal control systems. It creates
a critical first-line defense against
fraud, provides essential feedback to
management about the effectiveness
of operations and procedures, and
provides vital information to the board
of directors about the effectiveness of
internal control systems.
Mary Thorson Wright is a writer
in Virginia.
independentbanker.org // 23
http://www.independentbanker.org
Independent Banker - April 2023

Table of Contents for the Digital Edition of Independent Banker - April 2023
