# Bank Secrecy Act 

# REVIEW CONSIDERATIONS

## Review Considerations

# 

+-----------------------------+-----------------------------------------+
| **Review Area**             | **Requirements / Recommendations**      |
+-----------------------------+-----------------------------------------+
| **                          |                                         |
| Policy/Procedure/Program:** |                                         |
+-----------------------------+-----------------------------------------+
| BSA Compliance Policy and   | Establish and maintain a board-approved |
| Procedures                  | written program designed to monitor     |
|                             | compliance with the BSA and its         |
|                             | implementing regulations that must      |
|                             | include, at a minimum:                  |
|                             |                                         |
|                             | 1.  A system of internal controls;      |
|                             |                                         |
|                             | 2.  Daily coordination and monitoring   |
|                             |     of compliance by a designated       |
|                             |     person;                             |
|                             |                                         |
|                             | 3.  Independent testing of compliance;  |
|                             |     and                                 |
|                             |                                         |
|                             | 4.  Training for appropriate personnel. |
|                             |                                         |
|                             | The program should also include         |
|                             | procedural guidelines to ensure the     |
|                             | credit union will:                      |
|                             |                                         |
|                             | 1.  Meet the reporting and record       |
|                             |     keeping requirements of the BSA     |
|                             |     regulations.                        |
|                             |                                         |
|                             | 2.                                      |
|                             |                                         |
|                             | 3.  Detect, prevent, and report         |
|                             |     suspicious transactions related to  |
|                             |     money laundering.                   |
+-----------------------------+-----------------------------------------+
| Customer Identification     | Establish and maintain a board-approved |
| Program                     | written Customer Identification Program |
|                             | (CIP) in compliance with §103.121 that  |
|                             | is part of the credit union's BSA       |
|                             | program. The minimum requirements       |
|                             | include:                                |
|                             |                                         |
|                             | 1.  Obtainment of certain basic         |
|                             |     identifying data;                   |
|                             |                                         |
|                             | 2.  Verification of the identity of any |
|                             |     person who opens an account to the  |
|                             |     extent reasonable and practicable;  |
|                             |                                         |
|                             | 3.  Maintenance of records of the       |
|                             |     information used to verify the      |
|                             |     person's identity including name,   |
|                             |     address, and other identifying      |
|                             |     information; and                    |
|                             |                                         |
|                             | 4.  Determination whether the person    |
|                             |     appears on any lists of known or    |
|                             |     suspected terrorists or terrorist   |
|                             |     organizations provided to the       |
|                             |     credit union by any federal         |
|                             |     government agency.                  |
|                             |                                         |
|                             | In addition, the credit union must      |
|                             | provide adequate notice that it will    |
|                             | request information to verify           |
|                             | identities.                             |
|                             |                                         |
|                             | The CIP must also address procedures    |
|                             | for:                                    |
|                             |                                         |
|                             | 1.  Handling discrepancies in           |
|                             |     information received; and           |
|                             |                                         |
|                             | 2.  Conducting transactions while the   |
|                             |     identity is being verified.         |
|                             |                                         |
|                             | In addition, the CIP must have          |
|                             | procedures addressing when the credit   |
|                             | union can not determine, with a         |
|                             | reasonable belief, that the true        |
|                             | identity is known.                      |
|                             |                                         |
|                             | The policy should require periodic      |
|                             | testing to assure that the CIP is being |
|                             | properly implemented and complies with  |
|                             | the Treasury regulation.                |
+-----------------------------+-----------------------------------------+
| Anti-Money Laundering       | Develop procedures designed to detect   |
| Program                     | and/or prevent money laundering         |
|                             | activities that will:                   |
|                             |                                         |
|                             | 1.  Define money laundering in its      |
|                             |     different forms (placement,         |
|                             |     layering, integration).             |
|                             |                                         |
|                             | 2.  Address compliance with applicable  |
|                             |     anti-money laundering laws and      |
|                             |     regulations.                        |
|                             |                                         |
|                             | 3.  Identify high-risk business         |
|                             |     activities, businesses, and foreign |
|                             |     countries associated with money     |
|                             |     laundering.                         |
|                             |                                         |
|                             | Ensure that the anti-money laundering   |
|                             | procedures are extended to all areas of |
|                             | the credit union's operations including |
|                             | teller operations, loan department,     |
|                             | wire transfer room, and safe deposit    |
|                             | box activity.                           |
|                             |                                         |
|                             | Establish internal controls to minimize |
|                             | the risk of money laundering that       |
|                             | include:                                |
|                             |                                         |
|                             | 1.  Money laundering detection          |
|                             |     procedures.                         |
|                             |                                         |
|                             | 2.  Monitoring non-bank financial       |
|                             |     institution depositors with high    |
|                             |     volume cash activity.               |
|                             |                                         |
|                             | 3.  Periodic account activity           |
|                             |     monitoring.                         |
|                             |                                         |
|                             | 4.  Internal investigations,            |
|                             |     monitoring, and reporting of        |
|                             |     suspicious transactions.            |
+-----------------------------+-----------------------------------------+
| Special Information Sharing |                                         |
| Procedures:                 |                                         |
+-----------------------------+-----------------------------------------+
| *With Federal Law           | Upon receiving an information request   |
| Enforcement*                | from FinCEN, the credit union will have |
|                             | two weeks to search certain designated  |
| *(referred to as Section    | records and respond with any matches.   |
| 314(a) Request)*            | Generally, this is a one-time search,   |
|                             | unless specified in the request.        |
|                             |                                         |
|                             | If a match is found, stop the search on |
|                             | that subject and report the match to    |
|                             | FinCEN. If no match is found, no reply  |
|                             | should be made.                         |
|                             |                                         |
|                             | A point-of-contact (POC) to receive the |
|                             | information requests must be designated |
|                             | by each credit union and reported on    |
|                             | the quarterly call report.              |
|                             |                                         |
|                             | (Reference §103.100)                    |
+-----------------------------+-----------------------------------------+
| *Among Financial            | A credit union may voluntarily share    |
| Institutions*               | information with any other financial    |
|                             | institution for purposes of identifying |
|                             | and reporting activities involving      |
|                             | suspected terrorist activity or money   |
|                             | laundering.                             |
|                             |                                         |
|                             | Prior to sharing information, a 314(b)  |
|                             | Notice must be submitted to FinCEN.     |
|                             | This notice must be resubmitted each    |
|                             | year. In addition, prior to sharing     |
|                             | information, the credit union must      |
|                             | verify that the financial institution   |
|                             | with which it plans to share            |
|                             | information has also submitted a notice |
|                             | to FinCEN.                              |
|                             |                                         |
|                             | 314(b) Notices may be submitted by      |
|                             | accessing FinCEN's web site at:         |
|                             | [                                       |
|                             | www.fincen.gov](http://www.fincen.gov/) |
|                             | and clicking on "Section 314(b) Notif." |
|                             |                                         |
|                             | (Reference §103.110)                    |
+-----------------------------+-----------------------------------------+
| **REPORTS:**                |                                         |
+-----------------------------+-----------------------------------------+
| Currency Transaction Report | File, with the IRS, a completed CTR     |
| (CTR)                       | involving any transaction in currency   |
|                             | over \$10,000, including each deposit,  |
| (IRS Form 4789)             | withdrawal, currency exchange, or other |
|                             | payment or transfer.                    |
|                             |                                         |
|                             | Multiple transactions totaling more     |
|                             | than \$10,000 during any one-business   |
|                             | day are treated as a single transaction |
|                             | if the credit union has knowledge that  |
|                             | they are by or on behalf of any person. |
|                             | Beware of persons attempting to         |
|                             | structure currency transactions in such |
|                             | a manner to evade CTR filing            |
|                             | requirements.                           |
|                             |                                         |
|                             | The CTR must be filed with the Internal |
|                             | Revenue                                 |
|                             |                                         |
|                             | Service (IRS) within 15 days after the  |
|                             | date of the transaction with a copy     |
|                             | retained for at least 5 years.          |
+-----------------------------+-----------------------------------------+
| Designation of Exempt       | Currency transactions involving         |
| Person                      | transactions with "exempt persons" need |
|                             | not be reported. Exempt persons         |
| (TD Form 90-22.53)          | include:                                |
|                             |                                         |
|                             | 1.  Banks and credit unions in the      |
|                             |     United States;                      |
|                             |                                         |
|                             | 2.  Federal, state, or local            |
|                             |     governments; or                     |
|                             |                                         |
|                             | 3.  Corporations whose common stock is  |
|                             |     traded on the New York Stock        |
|                             |     Exchange, most corporations whose   |
|                             |     common stock is traded on the       |
|                             |     American Stock Exchange and the     |
|                             |     NASDAQ Stock Market, and certain    |
|                             |     subsidiaries of those corporations  |
|                             |     ("listed businesses") (See Section  |
|                             |     103.22(d)(2)).                      |
|                             |                                         |
|                             | 4.  Other commercial entities that have |
|                             |     had an account at the credit union  |
|                             |     for at least 12 months, are         |
|                             |     organized under U.S. or state law   |
|                             |     or are registered and eligible to   |
|                             |     do business in the U.S., and        |
|                             |     either: (1) frequently engage in    |
|                             |     transactions at the credit union    |
|                             |     exceeding \$10,000 ("non-listed     |
|                             |     businesses") or (2) operate a       |
|                             |     payroll business that regularly     |
|                             |     withdraws more than \$10,000 to pay |
|                             |     employees in the U.S. in currency   |
|                             |     ("payroll customers").              |
|                             |                                         |
|                             | For those "non-listed businesses" or    |
|                             | "payroll customers" the credit union    |
|                             | must file a TD Form 90-22.53 for the    |
|                             | required biennial renewal of the exempt |
|                             | person designation.                     |
|                             |                                         |
|                             | Businesses that do not qualify to       |
|                             | receive an exemption include:           |
|                             |                                         |
|                             | 1.  Financial institutions and their    |
|                             |     agents. (Banks, as defined in       |
|                             |     §103.11(c), are specifically exempt |
|                             |     persons (§103.22(d)(2)(i));         |
|                             |     financial institutions, which, as   |
|                             |     defined in §103.11(n) includes      |
|                             |     banks as well as broker-dealers,    |
|                             |     casinos, and money service business |
|                             |     in addition to others, can not be   |
|                             |     exempt.)                            |
|                             |                                         |
|                             | 2.  Dealers in automobiles, boats,      |
|                             |     vessels, aircraft, farm equipments, |
|                             |     or mobile homes, and those who      |
|                             |     charter or operate ships, buses, or |
|                             |     aircraft.                           |
|                             |                                         |
|                             | 3.  Lawyers, accountants, doctors,      |
|                             |     investment advisers, investment     |
|                             |     bankers, real estate or pawn        |
|                             |     brokers, title insurers, real       |
|                             |     estate closing businesses, auction  |
|                             |     businesses, and trade union         |
|                             |     businesses.                         |
|                             |                                         |
|                             | 4.                                      |
|                             |                                         |
|                             | 5.  Gaming of any type except licensed  |
|                             |     pari-mutuel betting at racetracks.  |
+-----------------------------+-----------------------------------------+
| Currency and Monetary       | File, with the appropriate U.S. Customs |
| Instrument Report (CMIR)    | officer or the Commissioner of Customs, |
|                             | a completed CMIR for each shipment of   |
| (U.S. Customs Form 4790)    | currency or other monetary              |
|                             | instrument(s) in excess of \$10,000 out |
|                             | of or into the U.S., except via the     |
|                             | postal service or common carrier. For   |
|                             | transport into or out of the U.S., file |
|                             | CMIR at time of entry into or departure |
|                             | from U.S. For receipt from outside the  |
|                             | U.S., file CMIR within 15 days of       |
|                             | receipt of instruments (unless a report |
|                             | has already been filed).                |
+-----------------------------+-----------------------------------------+
|                             |                                         |
+-----------------------------+-----------------------------------------+
| Report of Foreign Bank      | Each person subject to U.S.             |
| Financial Accounts          | jurisdiction with a financial interest  |
|                             | in, or signature authority over, a      |
| (Treasury Form 90-22.1)     | bank, securities, or other financial    |
|                             | account in a foreign country must       |
|                             | annually file a Report of Foreign Bank  |
|                             | Financial Accounts with the IRS, as     |
|                             | required by §103.24. The reports are    |
|                             | due on or before June 30 each calendar  |
|                             | year. This requirement includes credit  |
|                             | unions with such financial interests.   |
|                             |                                         |
|                             | Records of accounts reported must be    |
|                             | maintained for a period of 5 years      |
|                             | (§103.32).                              |
+-----------------------------+-----------------------------------------+
| Suspicious Activity Report  | File a completed SAR for any            |
| (SAR)                       | transaction involving \$5,000 or more   |
|                             | when the institution knows, suspects,   |
| (TD Form 90-22.47)          | or has reason to suspect that a         |
|                             | transaction:                            |
|                             |                                         |
|                             | 1.  Involves money laundering;          |
|                             |                                         |
|                             | 2.  Is designed to evade regulations    |
|                             |     promulgated under the BSA; or       |
|                             |                                         |
|                             | 3.  Has no business or apparent lawful  |
|                             |     purpose or is not of the type that  |
|                             |     the particular member would         |
|                             |     normally be expected to undertake.  |
|                             |                                         |
|                             | File a completed SAR for insider abuse  |
|                             | involving any amount.                   |
|                             |                                         |
|                             | Note: If the suspicious transaction     |
|                             | involves currency of more than          |
|                             | \$10,000, both a SAR and a              |
|                             |                                         |
|                             | CTR must be filed. For suspicious       |
|                             | transactions involving currency under   |
|                             | \$10,000, only a SAR need be filed.     |
|                             |                                         |
|                             | SARs must be sent to: Detroit Computing |
|                             | Center, P.O. Box 33980, Detroit, MI     |
|                             | 48232-0980 no later than 30 days after  |
|                             | the date of initial detection of facts  |
|                             | constituting a basis for the SAR        |
|                             | filing. If no suspect was initially     |
|                             | identified on the date of detection,    |
|                             | filing may be delayed for an additional |
|                             | 30 calendar days to identify a suspect. |
|                             | Do not include supporting               |
|                             | documentation.                          |
|                             |                                         |
|                             | Maintain copy of SAR filed along with   |
|                             | supporting documentation for a period   |
|                             | of 5 years.                             |
+-----------------------------+-----------------------------------------+
| **Record** **Keeping:**     |                                         |
+-----------------------------+-----------------------------------------+
| General Record Retention    | Ensure that the extensive record        |
| Requirements                | retention requirements (particularly    |
|                             | §§§103.33, 34, and 121 pertaining to    |
|                             | financial institutions) are             |
|                             | implemented. An institution is required |
|                             | to retain either the original,          |
|                             | microfilm, copy, or other reproduction  |
|                             | of the relevant documents. Records are  |
|                             | required to be retained at least 5      |
|                             | years in most cases.                    |
|                             |                                         |
|                             | **Effective October 1, 2003, the        |
|                             | requirements contained in §103.34(a)    |
|                             | will be deleted. Section 103.34(b) will |
|                             | remain in effect.**                     |
+-----------------------------+-----------------------------------------+
| Monetary Instruments Record | Maintain records of monetary instrument |
| Keeping Involving \$3,000   | (e.g., traveler's checks, money orders, |
| to \$10,000 in Currency     | cashier's checks) issuance or sale for  |
|                             | currency in amounts between \$3,000 and |
|                             | \$10,000, with supporting information   |
|                             | prescribed by §103.29(a).               |
|                             |                                         |
|                             | For deposit account holders:            |
|                             |                                         |
|                             | 1.  Name;                               |
|                             |                                         |
|                             | 2.  Date;                               |
|                             |                                         |
|                             | 3.  Type of instrument purchased;       |
|                             |                                         |
|                             | 4.  Serial number(s) of each            |
|                             |     instrument; and                     |
|                             |                                         |
|                             | 5.  Amount in dollars of each of the    |
|                             |     instruments purchased.              |
|                             |                                         |
|                             | For non-deposit holders:                |
|                             |                                         |
|                             | 1.  Name and address;                   |
|                             |                                         |
|                             | 2.  Social Security number;             |
|                             |                                         |
|                             | 3.  Date of birth;                      |
|                             |                                         |
|                             | 4.  Date;                               |
|                             |                                         |
|                             | 5.  Type of instrument purchased;       |
|                             |                                         |
|                             | 6.  Serial number(s) of each            |
|                             |     instrument; and                     |
|                             |                                         |
|                             | 7.  Amount in dollars of each of the    |
|                             |     instruments purchased.              |
|                             |                                         |
|                             | Contemporaneous purchases of the same   |
|                             | or different types of instruments       |
|                             | totaling \$3,000 or more must be        |
|                             | treated as one purchase. Also multiple  |
|                             | purchases totaling \$3,000 or more must |
|                             | be treated as a single purchase where   |
|                             | the employee has knowledge that these   |
|                             | multiple purchases occurred.            |
|                             |                                         |
|                             | Verify that the purchaser is a deposit  |
|                             | accountholder or verify purchaser's     |
|                             | identity in the manner described at     |
|                             | Sections 103.29(a)(1)(ii) and           |
|                             | 103.29(a)(2)(ii).                       |
+-----------------------------+-----------------------------------------+
| Records of Wire (Funds)     | Collect and retain the information      |
| Transfer                    | specified in §103.33(e) and (g) for all |
|                             | wire (funds) transfers in the amount of |
|                             | \$3,000 or more. The information to be  |
|                             | collected and retained depends upon:    |
|                             | (1) the type of financial institution,  |
|                             | (2) its role in the wire transfer       |
|                             | (originator, intermediary, or           |
|                             | beneficiary), (3) the amount of the     |
|                             | wire transfer, and (4) the relationship |
|                             | of the parties to the transaction with  |
|                             | the financial institution.              |
|                             |                                         |
|                             | The record keeping requirements are not |
|                             | required where the originator and       |
|                             | beneficiary are any of the following:   |
|                             |                                         |
|                             | 1.  A domestic bank;                    |
|                             |                                         |
|                             | 2.  A wholly-owned domestic subsidiary  |
|                             |     of a domestic bank;                 |
|                             |                                         |
|                             | 3.  A broker or dealer in securities;   |
|                             |                                         |
|                             | 4.  The U.S. government;                |
|                             |                                         |
|                             | 5.  A state or local government; and    |
|                             |                                         |
|                             | 6.  A federal, state or local           |
|                             |     government agency or                |
|                             |     instrumentality.                    |
|                             |                                         |
|                             | If the originator and beneficiary are   |
|                             | the same and the institutions involved  |
|                             | in the funds transfer are the same, the |
|                             | transfer is also exempt.                |
|                             |                                         |
|                             | Audit procedures should verify that:    |
|                             |                                         |
|                             | 1.  A separation of duties ensures      |
|                             |     proper authorization for sending    |
|                             |     and receiving transfers and for     |
|                             |     correct account posting.            |
|                             |                                         |
|                             | 2.  CTRs are properly filed for         |
|                             |     non-members submitting cash for     |
|                             |     funds transfers.                    |
|                             |                                         |
|                             | 3.  Fund transfers to/from foreign      |
|                             |     institutions involve amounts,       |
|                             |     frequency and countries consistent  |
|                             |     with the member's business.         |
|                             |                                         |
|                             | 4.  Accounts with frequent cash         |
|                             |     deposits and subsequent wire        |
|                             |     transfers of funds to larger        |
|                             |     institutions are closely monitored. |
+-----------------------------+-----------------------------------------+
| Internal Controls           | Institute internal audit procedures or  |
|                             | a management review process designed    |
|                             | to:                                     |
|                             |                                         |
|                             | 1.  Confirm the integrity and accuracy  |
|                             |     of report of large currency         |
|                             |     transactions.                       |
|                             |                                         |
|                             | 2.  Include a review of tellers'        |
|                             |     activities that relate to BSA and   |
|                             |     Forms 4789 and 4790.                |
|                             |                                         |
|                             | 3.  Confirm the integrity and accuracy  |
|                             |     of record keeping activities and    |
|                             |     adherence to the in-house record    |
|                             |     retention schedule.                 |
|                             |                                         |
|                             | 4.  Ascertain whether a list of exempt  |
|                             |     members is being properly           |
|                             |     maintained.                         |
|                             |                                         |
|                             | 5.  Test the reasonableness of the      |
|                             |     exemptions granted.                 |
|                             |                                         |
|                             | 6.  Confirm that records of cash        |
|                             |     purchases of monetary instruments   |
|                             |     (in amounts from \$3,000 to         |
|                             |     \$10,000) are maintained and that   |
|                             |     appropriate identification measures |
|                             |     are in place.                       |
|                             |                                         |
|                             | 7.  Review effectiveness of training    |
|                             |     program.                            |
|                             |                                         |
|                             | 8.  Conduct audits as frequently as is  |
|                             |     appropriate given volume/complexity |
|                             |     of transactions, but at least       |
|                             |     annually.                           |
|                             |                                         |
|                             | 9.  Test CIP and related recordkeeping  |
|                             |     requirements.                       |
+-----------------------------+-----------------------------------------+
|                             | 1.                                      |
|                             | 2.                                      |
|                             | 3.                                      |
|                             | 4.                                      |
|                             | 5.                                      |
|                             | 6.                                      |
|                             | 7.                                      |
|                             | 8.                                      |
|                             | 9.                                      |
|                             | 10.                                     |
|                             | 11.                                     |
|                             | 12.                                     |
|                             | 13.                                     |
|                             | 14.                                     |
|                             | 15.                                     |
|                             | 16.                                     |
|                             | 17.                                     |
|                             | 18.                                     |
|                             | 19.                                     |
|                             | 20.                                     |
|                             | 21.                                     |
|                             | 22.                                     |
|                             | 23.                                     |
|                             | 24.                                     |
+-----------------------------+-----------------------------------------+
| 25.                         |                                         |
+-----------------------------+-----------------------------------------+
|                             |                                         |
+-----------------------------+-----------------------------------------+
|                             | 4.                                      |
|                             | 5.                                      |
|                             | 6.                                      |
|                             | 7.                                      |
|                             | 8.                                      |
|                             | 9.                                      |
|                             | 10.                                     |
+-----------------------------+-----------------------------------------+
| 11. Training and Education  | Establish a program for training        |
|                             | appropriate employees regarding BSA and |
|                             | money laundering that includes the      |
|                             | following:                              |
|                             |                                         |
|                             | 1.  Reporting of large currency         |
|                             |     transactions.                       |
|                             |                                         |
|                             | 2.  Exemptions from reporting.          |
|                             |                                         |
|                             | 3.  Sale of monetary instruments.       |
|                             |                                         |
|                             | 4.  Reporting suspicious activity or    |
|                             |     alleged criminal conduct.           |
|                             |                                         |
|                             | 5.  Examples of money laundering and    |
|                             |     how to detect, resolve and report   |
|                             |     such activity.                      |
|                             |                                         |
|                             | 6.  Overview of various forms that      |
|                             |     money laundering can take.          |
|                             |                                         |
|                             | 7.  Wire (fund) transfer activity.      |
|                             |                                         |
|                             | 8.  Payable through accounts.           |
|                             |                                         |
|                             | 9.  Filing of SARs.                     |
+-----------------------------+-----------------------------------------+
|                             |                                         |
+-----------------------------+-----------------------------------------+
|                             | 1.                                      |
|                             | 2.                                      |
|                             | 3.                                      |
|                             | 4.                                      |
|                             | 5.                                      |
|                             | 6.                                      |
|                             | 7.                                      |
|                             | 8.                                      |
+-----------------------------+-----------------------------------------+
|                             | 1.                                      |
|                             | 2.                                      |
|                             | 3.                                      |
|                             | 4.                                      |
+-----------------------------+-----------------------------------------+
|                             |                                         |
+-----------------------------+-----------------------------------------+
|                             |                                         |
+-----------------------------+-----------------------------------------+
|                             |                                         |
+-----------------------------+-----------------------------------------+
|                             |                                         |
+-----------------------------+-----------------------------------------+