**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Enterprise-Wide BSA/AML Compliance
Program**

**OBJECTIVE**

Assess the holding companies' and lead financial institution's[^1]
program for BSA/AML compliance.

**PROCEDURES**

1.  Confirm the existence and review the scope of any enterprise-wide
    BSA/AML compliance program. Communicate with peers at other federal
    and state banking agencies, as necessary, to confirm their
    understanding of the organization's BSA/AML compliance program. This
    approach promotes consistent supervision and lessens regulatory
    burden for the holding company. Determine the extent to which the
    enterprise-wide BSA/AML compliance program affects the organization
    being examined, considering the following:

-   The existence of enterprise-wide operations or functions responsible
    for day-to-day BSA/AML operations, including, but not limited to,
    the centralization of suspicious activity monitoring and reporting,
    currency transaction reporting, currency exemption review and
    reporting, and recordkeeping activities.

-   The centralization of operational units, such as financial
    intelligence units, dedicated to and responsible for monitoring
    transactions across legal entities, functional lines of business, or
    product lines. (Assess the variety and extent of information that
    data or transaction sources (e.g., banks, broker/dealers, trust
    companies, Edge Act and agreement corporations, insurance companies,
    or foreign branches) are entering into the monitoring and reporting
    systems.)

-   The extent to which the holding company or lead financial
    institution (or other corporate-level unit, such as audit or
    compliance) performs regular independent testing of BSA/AML
    activities.

-   Whether a corporate-level unit sponsors BSA/AML training.

2.  Review audits for BSA/AML compliance and identification of program
    deficiencies.

3.  Review board minutes to determine the adequacy of management
    information systems (MIS) and of reports provided to the board of
    directors. Ensure that the board of directors of the holding company
    has received appropriate notification of Suspicious Activity Reports
    (SARs) filed by the holding company.

4.  Review policies, procedures, processes, and risk assessments
    formulated and implemented by the holding company or lead financial
    institution board of directors, a board committees thereof, or
    senior management. As part of this review, assess effectiveness of
    the holding company's or lead financial institution's ability to
    perform the following responsibilities:

-   Manage the enterprise-wide BSA/AML compliance program and provide
    adequate oversight and structure.

-   Promptly identify and effectively measure, monitor and control key
    risks throughout the consolidated organization.

-   Develop an adequate enterprise-wide risk assessment and the
    policies, procedures, and processes to comprehensively manage those
    risks.

-   Develop procedures for evaluation, approval, and oversight of risk
    limits, new business initiatives, and strategic changes.

-   Oversee the compliance of subsidiaries with applicable regulatory
    requirements (e.g., country and industry requirements).

-   Oversee the compliance of subsidiaries with the requirements of the
    enterprise-wide BSA/AML compliance program, as established by the
    holding company or lead financial institution.

-   Identify enterprise-wide program weaknesses and implement necessary
    and timely corrective action, at both the holding company and
    subsidiary levels.

5.  To ensure compliance with regulatory requirements,[^2] review the
    holding company's or the lead financial institution's procedures for
    monitoring and filing SARs. Refer to the core overview and
    procedures sections for "Suspicious Activity Reporting" on pages 40
    and 183, respectively.

6.  Once the examiner has completed the above procedures, examiners
    should discuss their findings with the following parties, as
    appropriate:

-   Person (or persons) responsible for ongoing supervision of the
    organization and subsidiary banks, as appropriate.

-   Corporate management.

7.  On the basis of procedures completed, form a conclusion about the
    adequacy of policies, procedures, and processes associated with
    enterprise-wide BSA/AML compliance programs.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Correspondent Accounts (Domestic)**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with offering domestic correspondent account relationships, and
management's ability to implement effective monitoring and reporting
systems.

**PROCEDURES**

1.  Review the policies, procedures, and processes related to domestic
    correspondent banking relationships. Evaluate the adequacy of the
    policies, procedures, and processes given the bank's domestic
    correspondent accounts and the risks they present. Ensure that
    controls are adequate to reasonably protect the bank from money
    laundering and terrorist financing.

2.  From a review of management information systems (MIS) and internal
    risk rating factors, determine whether the bank has identified any
    domestic correspondent banking activities as high risk.

3.  Determine whether the bank's system for monitoring domestic
    correspondent accounts for suspicious activities, and for reporting
    suspicious activities, is adequate given the bank's size,
    complexity, location, and types of customer relationships.

4.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING\
**

5.  On the basis of the bank's review of respondent accounts with
    unusual or high-risk activity, its risk assessment, and prior
    examination and audit reports, select a sample of respondent
    accounts. From the sample selected perform the following procedures:

-   Review bank statements for domestic correspondent accounts.

-   Review large or unusual transactions to determine their nature. As
    necessary, obtain and review copies of credit or debit advices,
    general ledger tickets, and other supporting documentation.

-   Note any currency shipments or deposits made on behalf of individual
    customers to a correspondent bank for credit to the customer's
    account at the correspondent bank. Determine whether Currency
    Transaction Reports (CTRs) are properly filed.

6.  Review the bank statements for domestic correspondent account
    records, or telex records of accounts controlled by the same person
    for large deposits of cashier's checks, money orders, or similar
    instruments drawn on other banks in amounts under \$10,000. These
    funds may possibly be transferred elsewhere in bulk amounts. Note
    whether the instruments under \$10,000 are sequentially numbered.

7.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with domestic correspondent bank relationships.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Correspondent Accounts (Foreign)**

**OBJECTIVE**

Assess the adequacy of the U.S. bank's systems to manage the risks
associated with foreign correspondent banking. and management's ability
to implement effective due diligence, monitoring, and reporting systems.
This section expands the earlier core review of statutory and regulatory
requirements of foreign correspondent account relationships in order to
provide a broader assessment of the AML risks associated with this
activity.

**PROCEDURES**

1.  Review the policies, procedures, and processes related to foreign
    correspondent financial institution account relationships. Evaluate
    the adequacy of the policies, procedures, and processes. Ensure that
    controls are adequate to reasonably protect the U.S. bank from money
    laundering and terrorist financing.

2.  From a review of management information systems (MIS) and internal
    risk-rating factors, determine whether the U.S. bank effectively
    identifies and monitors foreign correspondent financial institution
    account relationships, particularly those that pose a higher risk
    for money laundering.

3.  If the U.S. bank has a standardized foreign correspondent agreement,
    review a sample agreement to determine whether each party's
    responsibilities, products and services provided, and client
    referral guidelines are covered under the contractual arrangement.
    If the U.S. bank does not have a standardized agreement, refer to
    the transaction testing procedures.

4.  Determine whether the U.S. bank's system for monitoring foreign
    correspondent financial institution account relationships for
    suspicious activities, and for reporting suspicious activities, is
    adequate given the U.S. bank's size, complexity, location, and types
    of customer relationships.

5.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

6.  On the basis of the U.S. bank's risk assessment of its foreign
    correspondent activities, as well as prior examination and audit
    reports, select a sample of high-risk foreign correspondent
    financial institution account relationships. The high-risk sample
    should include relationships with foreign financial institutions
    located in jurisdictions that do not cooperate with international
    AML efforts and in other jurisdictions as designated by the U.S.
    bank, including correspondent accounts for small financial
    institutions. From the sample selected perform the following
    procedures:

-   Review a foreign correspondent agreement or contract that delineates
    each party's responsibilities and the products and services
    provided.

-   Review U.S. bank statements for foreign correspondent accounts and,
    as necessary, specific transaction details. Compare expected
    transactions with actual activity.

-   Determine whether actual activity is consistent with the nature of
    the customer's business. Identify any unusual or suspicious
    activity.

-   Review large or unusual transactions to determine their nature. As
    necessary, obtain and review copies of credit or debit advices,
    general ledger tickets, and other supporting documentation.

-   Analyze transactions to identify behavior indicative of nested
    accounts, intermediary or clearing agent services, or other services
    for third-party foreign financial institutions that have not been
    clearly identified.

7.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with foreign correspondent financial
    institution relationships.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- U.S. Dollar Drafts**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with U.S. dollar drafts, and management's ability to implement effective
monitoring and reporting systems.

**PROCEDURES**

1.  Review the policies, procedures, and processes related to U.S.
    dollar drafts. Evaluate the adequacy of the policies, procedures,
    and processes given the bank's U.S. dollar draft activities and the
    risks they present. Ensure that controls are adequate to reasonably
    protect the bank from money laundering and terrorist financing.
    Determine whether policies address the following:

-   Criteria for allowing a foreign financial institution or entity to
    issue the U.S. bank's dollar drafts (e.g., jurisdiction; products,
    services, and target markets; purpose of account and anticipated
    activity; customer history; and other available information.)

-   Identification of unusual transactions (e.g., structuring
    transactions or the purchase of multiple sequentially numbered U.S.
    dollar drafts to the same payee).

-   Criteria for ceasing U.S. dollar draft issuance through a foreign
    financial institution or entity.

2.  From a review of management information systems (MIS) and internal
    risk rating factors, determine whether the bank effectively
    identifies and monitors high-risk U.S. dollar draft accounts.

3.  Determine whether the bank's system for monitoring U.S. dollar draft
    accounts for suspicious activities, and for reporting suspicious
    activities, is adequate given the bank's size, complexity, location,
    and types of customer relationships.

4.  Obtain a list of foreign bank correspondent accounts in which U.S.
    dollar drafts are offered. Review the volume, by number and dollar
    amount, of monthly transactions for each account. Determine whether
    management has appropriately assessed risk.

**TRANSACTION TESTING**

5.  On the basis of the bank's risk assessment of its U.S. dollar draft
    activities, as well as prior examination and audit reports, select a
    sample of foreign correspondent bank accounts in which U.S. dollar
    drafts are processed. In the sample selected, include accounts with
    a high volume of U.S. dollar draft activity. From the sample
    selected, perform the following procedures:

-   Review transactions for sequentially numbered U.S. dollar drafts to
    the same payee or from the same remitter. Research any unusual or
    suspicious U.S. dollar draft transactions.

-   Review the bank's contracts and agreements with foreign
    correspondent banks. Determine whether contracts address procedures
    for processing and clearing U.S. dollar drafts.

-   Verify that the bank has obtained and reviewed information about the
    foreign financial institution's home country AML regulatory
    requirements (e.g., customer identification and suspicious activity
    reporting).

6.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with U.S. dollar drafts.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Payable Through Accounts**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with payable through accounts (PTAs), and management's ability to
implement effective monitoring and reporting systems.

**PROCEDURES**

1.  Review the policies, procedures, and processes related to PTAs.
    Evaluate the adequacy of the policies, procedures, and processes
    given the bank's PTA activities and the risks they present. Ensure
    that controls are adequate to reasonably protect the bank from money
    laundering and terrorist financing. Determine whether:

-   Criteria for opening PTA relationships with a foreign financial
    institution are adequate. Examples of factors that may be used
    include: jurisdiction; bank secrecy or money laundering haven;
    products, services, and markets; purpose; anticipated activity;
    customer history; ownership; senior management; certificate of
    incorporation; banking license; certificate of good standing; and
    demonstration of the foreign financial institution's operational
    capability to monitor account activity.

-   Appropriate information has been obtained and validated from the
    foreign financial institution concerning the identity of any persons
    having authority to direct transactions through the PTA.

-   Information and enhanced due diligence has been obtained from the
    foreign financial institution concerning the source and beneficial
    ownership of funds of persons who have authority to direct
    transactions through the PTA (e.g., name, address, expected activity
    level, place of employment, description of business, related
    accounts, identification of foreign politically exposed persons,
    source of funds, and articles of incorporation).

-   Sub-accounts are not opened before the U.S. bank has reviewed and
    approved the customer information.

-   Master or sub-accounts can be closed if the information provided to
    the bank has been materially inaccurate or incomplete.

-   The bank can identify all signers on each sub-account.

2.  From a review of management information systems (MIS) and internal
    risk rating factors, determine whether the bank effectively
    identifies and monitors PTA accounts.

3.  Determine whether the bank's system for monitoring PTA accounts for
    suspicious activities, and reporting suspicious activities, is
    adequate given the bank's size, complexity, location, and types of
    customer relationships.

4.  To assess the volume of risk and determine whether adequate
    resources are allocated to the oversight and monitoring activity,
    obtain a list of foreign correspondent bank accounts in which PTAs
    are offered and request MIS reports that show:

-   The number of sub-accounts within each PTA.

-   The volume and dollar amount of monthly transactions for each
    sub-account.

5.  Verify that the bank has obtained and reviewed information
    concerning the foreign financial institution's home country AML
    regulatory requirements (e.g., customer identification requirements
    and suspicious activity reporting) and considered these requirements
    when reviewing PTAs. Determine that the bank has ensured that
    sub-account agreements comply with any AML statutory and regulatory
    requirements existing in the foreign financial institution's home
    country.

6.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

7.  On the basis of the bank's risk assessment of its PTA activities, as
    well as prior examination and audit reports, select a sample of
    PTAs. From the sample, review the contracts or agreements with the
    foreign financial institution. Determine whether the contracts or
    agreements:

-   Clearly outline the contractual responsibilities of both the U.S.
    bank and the foreign financial institution.

-   Define PTA and sub-account opening procedures and require an
    independent review and approval process when opening the account.

-   Require the foreign financial institution to comply with its local
    AML requirements.

-   Restrict sub-accounts from being opened by casas de cambio, finance
    companies, funds remitters, or other non-bank financial
    institutions.

-   Prohibit multi-tier sub-accountholders.

-   Provide for proper controls over currency deposits and withdrawals
    by sub-accountholders and ensure that Currency Transaction Reports
    (CTRs) have been appropriately filed.

-   Provide for dollar limits on each sub-accountholder's transactions
    that are consistent with expected account activity.

-   Contain documentation requirements that are consistent with those
    used for opening domestic accounts at the U.S. bank.

-   Provide the U.S. bank with the ability to review information
    concerning the identity of sub-accountholders (e.g., directly or
    through a trusted third party).

-   Require the foreign financial institution to monitor sub-account
    activities for unusual or suspicious activity and report findings to
    the U.S. bank.

-   Allow the U.S. bank, as permitted by local laws, to audit the
    foreign financial institution's PTA operations and to access PTA
    documents.

8.  Review PTA master-account bank statements. (The examiner should
    determine the time period based upon the size and complexity of the
    bank.) The statements chosen should include frequent transactions
    and those of large dollar amounts. Verify the statements to the
    general ledger and bank reconcilements. Note any currency shipments
    or deposits made at the U.S. bank on behalf of an individual
    sub-accountholder for credit to the customer's sub-account.

9.  From the sample selected, review each sub-accountholder's
    identifying information and related transactions for a period of
    time as determined by the examiner. Evaluate PTA sub-accountholder's
    transactions. Determine whether the transactions are consistent with
    expected transactions or warrant further research. (The sample
    should include sub-accountholders with significant dollar activity.)

10. On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with PTAs.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Pouch Activities**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with pouch activities, and management's ability to implement effective
monitoring and reporting systems.

**PROCEDURES**

1.  Determine whether the bank has incoming or outgoing pouch activity
    and whether the activity is via carrier or courier.

2.  Review the policies, procedures, and processes, and any contractual
    agreements related to pouch activities. Evaluate the adequacy of the
    policies, procedures, and processes given the bank's pouch
    activities and the risks they present. Ensure that controls are
    adequate to reasonably protect the bank from money laundering and
    terrorist financing.

3.  From a review of management information systems (MIS) and internal
    risk rating factors, determine whether the bank effectively
    identifies and monitors pouch activities.

4.  Determine whether the bank's system for monitoring pouch activities
    for suspicious activities, and for reporting suspicious activities,
    is adequate given the bank's size, complexity, location, and types
    of customer relationships.

5.  Review the list of bank customers permitted to use pouch services
    (incoming and outgoing). Determine whether management has assessed
    the risk of the customers permitted to use this service.

6.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

7.  On the basis of the bank's risk assessment of its pouch activities,
    as well as prior examination and audit reports, and recent activity
    records, select a sample of daily pouches for review. Preferably on
    an unannounced basis and over a period of several days, not
    necessarily consecutive, observe the pouch opening and the data
    capture process for items contained in a sample of incoming pouches,
    and observe the preparation of outgoing pouches. Review the records
    and the pouch contents for currency, monetary instruments,[^3]
    bearer securities, stored value cards, gems, art, illegal substances
    or contraband, or other items that should not ordinarily appear in a
    bank's pouch.

8.  If the courier, or the referral agent who works for the courier, has
    an account with the bank, review an appropriate sample of their
    account activity.

9.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with pouch activity.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Foreign Branches and Offices of
U.S. Banks**

**OBJECTIVE**

Assess the adequacy of the U.S. bank's systems to manage the risks
associated with its foreign branches and offices, and management's
ability to implement effective monitoring and reporting systems.

### **PROCEDURES**

### 

1.  Review the policies, procedures, and processes related to foreign
    branches and offices[^4] to evaluate their adequacy given the
    activity in relation to the bank's risk, and ensure that controls
    are adequate to reasonably protect the bank from money laundering
    and terrorist financing.

2.  On the basis of a review of management information systems (MIS) and
    internal risk rating factors, determine whether the U.S. bank's head
    office effectively identifies and monitors foreign branches and
    offices, particularly those conducting high-risk transactions or
    located in high-risk jurisdictions.

3.  Determine whether the U.S. bank's head office system for monitoring
    foreign branches and offices and detecting unusual or suspicious
    activities at those branches and offices is adequate given the
    bank's size, complexity, location, and types of customer
    relationships. Determine whether the host country requires reporting
    of suspicious activities and, if permitted and available, review
    those reports. Determine whether this information is provided to the
    U.S. bank's head office and filtered into a bank-wide or, if
    appropriate, an enterprise-wide assessment of suspicious activities.

4.  Review the bank's organizational structure which should include a
    list of all legal entities and the countries in which they are
    registered. Determine the locations of foreign branches and offices,
    including the foreign regulatory environment and the degree of
    access by U.S. regulators for on-site examinations and customer
    records.

5.  Review any partnering or outsourcing relationships of foreign
    branches and offices. Determine whether the relationship is
    consistent with the bank's AML program.

6.  Determine the type of products, services, customers, and geographic
    locations served by the foreign branches and offices. Review the
    risk assessments of the foreign branches and offices.

7.  Review the management, compliance, and audit structure of the
    foreign branches and offices. Identify the decisions that are made
    at the bank's U.S. head office level versus those that are made at
    the foreign branch or office.

8.  Determine the involvement of the U.S. bank's head office in managing
    and monitoring foreign branches and offices. Conduct a preliminary
    evaluation of the foreign branches or offices through discussions
    with senior management at the U.S. bank's head office (e.g.,
    operations, customers, jurisdictions, products, services, management
    strategies, audit programs, anticipated product lines, management
    changes, branch expansions, AML risks, and AML programs). Similar
    discussions should occur with management of the foreign branches and
    offices, particularly those that may be considered higher risk.

9.  Coordinate with the host country supervisor and, if applicable, U.S.
    federal and state regulatory agencies. Discuss their assessment of
    the foreign branches' and offices' compliance with local laws.
    Determine whether there are any restrictions on materials that may
    be reviewed, copied, or taken out of the country.

10. If available, review the following:

-   Previous regulatory examination reports.

-   Host country's regulatory examination report.

-   Audit reports and supporting documentation.

-   Compliance reviews and supporting documentation.

11. If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

12. Make a determination whether transaction testing is feasible. If
    feasible, on the basis of the bank's risk assessment of this
    activity, and prior examination and audit reports, select a sample
    of high-risk foreign branch and office activity. Complete
    transaction testing from appropriate expanded examination procedures
    sections (e.g., pouch activity).

13. On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with the U.S. bank's foreign branches and
    offices.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Parallel Banking**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with parallel banking relationships, and management's ability to
implement effective due diligence, monitoring, and reporting systems.

**PROCEDURES**

1.  Determine whether parallel banking relationships exist through
    discussions with management or by reviewing inter-party activities
    involving the bank and another foreign financial institution. Review
    the policies, procedures, and processes related to parallel banking
    relationships. Evaluate the adequacy of the policies, procedures,
    and processes given the bank's parallel banking activities and the
    risks they present. Ensure that controls are adequate to reasonably
    protect the bank from money laundering and terrorist financing.

2.  Determine whether there are any conflicts of interest or differences
    in policies, procedures, and processes between parallel bank
    relationships and other foreign correspondent bank relationships.
    Particular consideration should be given to funds transfer, pouch,
    and payable through activities because these activities are more
    vulnerable to money laundering. If the bank engages in any of these
    activities, examiners should consider completing applicable expanded
    examination procedures that address each of these topics.

3.  From a review of management information systems (MIS) and internal
    risk rating factors, determine whether the bank effectively
    identifies and monitors parallel banking relationships, particularly
    those that pose a high-risk for money laundering.

4.  Determine whether the bank's system for monitoring parallel banking
    relationships for suspicious activities, and for reporting
    suspicious activities, is adequate given the bank's size,
    complexity, location, and types of customer relationships.

5.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

6.  On the basis of the bank's risk assessment of its parallel banking
    activities, as well as prior examination and audit reports, select a
    sample of high-risk activities from parallel banking relationships
    (e.g., foreign correspondent banking, funds transfer, payable
    through accounts, and pouch).

7.  Consider the location of the foreign parallel financial institution.
    If the jurisdiction is high risk, examiners should review a larger
    sample of transactions between the two institutions. Banks doing
    business with parallel foreign banking organizations in countries
    not designated as high risk may still require enhanced due
    diligence, but that determination will be on the basis of the size,
    nature, and type of the transactions between the institutions.

8.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with parallel banking organizations. Focus on
    whether controls exist to ensure independent and arms-length
    dealings between the two entities. If significant concerns are
    raised about the relationship between the two entities, recommend
    that this information be forwarded to the appropriate supervisory
    authorities.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Electronic BankingOBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with electronic banking (e-banking) customers, and management's ability
to implement effective monitoring and reporting systems.

**PROCEDURES**

1.  Review the policies, procedures, and processes related to e-banking.
    Evaluate the adequacy of the policies, procedures, and processes
    given the bank's e-banking activities and the risks they present.
    Ensure that controls are adequate to reasonably protect the bank
    from money laundering and terrorist financing.

2.  From a review of management information systems (MIS) and internal
    risk rating factors, determine whether the bank effectively
    identifies and monitors high-risk e-banking activities.

3.  Determine whether the bank's system for monitoring e-banking for
    suspicious activities, and for reporting suspicious activities, is
    adequate given the bank's size, complexity, location, and types of
    customer relationships.

4.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

5.  On the basis of the bank's risk assessment of its e-banking
    activities, as well as prior examination and audit reports, select a
    sample of e-banking accounts. From the sample selected perform the
    following procedures:

-   Review account opening documentation, including Customer
    Identification Program (CIP) and transaction history.

-   Compare expected activity with actual activity.

-   Determine whether the activity is consistent with the nature of the
    customer's business.

-   Identify any unusual or suspicious activity.

6.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with e-banking relationships.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Funds Transfers**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with funds transfers, and management's ability to implement effective
monitoring and reporting systems. This section expands the core review
of the statutory and regulatory requirements of funds transfers to
provide a broader assessment of AML risks associated with this activity.

**PROCEDURES**

1.  Review the policies, procedures, and processes related to funds
    transfers. Evaluate the adequacy of the policies, procedures, and
    processes given the bank's funds transfer activities and the risks
    they present. Ensure that controls are adequate to reasonably
    protect the bank from money laundering and terrorist financing.

2.  From review of management information systems (MIS) and internal
    risk rating factors, determine whether the bank effectively
    identifies and monitors high-risk funds transfer activities.

3.  Evaluate the bank's risks related to funds transfer activities by
    analyzing the frequency and dollar volume of funds transfers in
    relation to the bank's size, its location, and the nature of its
    customer account relationships.

4.  Determine whether the bank's system for monitoring funds transfers
    suspicious activities, and for reporting of suspicious activities,
    is adequate given the bank's size, complexity, location, and types
    of customer relationships. Determine whether suspicious activity
    monitoring and reporting systems include:

-   Funds transfers purchased with currency.

-   Transactions in which the bank is acting as an intermediary.

-   Transactions in which the bank is originating or receiving funds
    transfers from foreign financial institutions, particularly to or
    from jurisdictions with strict privacy and secrecy laws or those
    identified as high risk.

-   Frequent currency deposits and subsequent transfers, particularly to
    a larger institution or out of the country.

5.  Determine the bank's procedures for PUPID transactions.

-   Beneficiary bank -- determine how the bank disburses the proceeds
    (i.e., by currency or official check).

```{=html}
<!-- -->
```
-   Originating bank -- determine whether the bank allows PUPID funds
    transfers for noncustomers. If so, determine the type of funds
    accepted (i.e., by currency or official check).

6.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

7.  On the basis of the bank's risk assessment of funds transfer
    activities, as well as prior examination and audit reports, select a
    sample of high-risk funds transfer activities, which may include the
    following:

-   Funds transfers purchased with currency.

-   Transactions in which the bank is acting as an intermediary.

-   Transactions in which the bank is originating or receiving funds
    transfers from foreign financial institutions, particularly to or
    from jurisdictions with strict privacy and secrecy laws or those
    identified as high risk.

-   PUPID transactions.

8.  From the sample selected, analyze funds transfers to determine
    whether the amounts, frequency, and jurisdictions of origin or
    destination are consistent with the nature of the business or
    occupation of the customer. Identify any suspicious or unusual
    activity.

9.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with funds transfer activity.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Electronic Cash**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with electronic cash (e-cash), and management's ability to implement
effective monitoring and reporting systems.

**PROCEDURES**

1.  Review the policies, procedures, and processes related to e-cash.
    Evaluate the adequacy of the policies, procedures, and processes
    given the bank's e-cash activities and the risk they present. Ensure
    that controls are adequate to reasonably protect the bank from money
    laundering and terrorist financing.

2.  From a review of management information systems (MIS) and internal
    risk rating factors, determine whether the bank effectively
    identifies and monitors high-risk e-cash transactions.

3.  Determine whether the bank's system for monitoring e-cash
    transactions for suspicious activities, and for reporting suspicious
    activities, is adequate given the bank's size, complexity, location,
    and types of customer relationships.

4.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

5.  On the basis of the bank's risk assessment of its e-cash activities,
    as well as prior examination and audit reports, select a sample of
    e-cash transactions. From the sample selected perform the following
    procedures:

-   Review account opening documentation, including Customer
    Identification Program (CIP) and transaction history.

-   Compare expected activity with actual activity.

-   Determine whether the activity is consistent with the nature of the
    customer's business.

-   Identify any unusual or suspicious activity.

6.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with e-cash relationships.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Third-Party Payment Processors**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with its relationships with third-party payment processors, and
management's ability to implement effective monitoring and reporting
systems.

#### PROCEDURES

1.  Review the policies, procedures, and processes related to
    third-party payment processors (processors). Evaluate the adequacy
    of the policies, procedures, and processes given the bank's
    processor activities and the risks they present. Ensure that
    controls are adequate to reasonably protect the bank from money
    laundering and terrorist financing.

2.  From a review of management information systems (MIS) and internal
    risk rating factors, determine whether the bank effectively
    identifies and monitors processor relationships, particularly those
    that pose a high risk for money laundering.

3.  Determine whether the bank's system for monitoring processor
    accounts for suspicious activities, and for reporting suspicious
    activities, is adequate given the bank's size, complexity, location,
    and types of customer relationships.

4.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

5.  On the basis of the bank's risk assessment of its processor
    activities, as well as prior examination and audit reports, select a
    sample of high-risk processor accounts. From the sample selected:

-   Review account opening documentation and ongoing due diligence
    information.

-   Review account statements and, as necessary, specific transaction
    details to determine how expected transactions compare with actual
    activity.

-   Determine whether actual activity is consistent with the nature of
    the processor's stated activity.

-   Identify any unusual or suspicious activity.

6.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with processor accounts.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Purchase and Sale of Monetary
Instruments**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with monetary instruments, and management's ability to implement
effective monitoring and reporting systems. This section expands the
core review of statutory and regulatory requirements for purchase and
sale of monetary instruments in order to provide a broader assessment of
the money laundering risks associated with this activity.

**PROCEDURES**

1.  Review the policies, procedures, and processes related to the sale
    of monetary instruments. Evaluate the adequacy of the policies,
    procedures, and processes given the bank's monetary instruments
    activities and the risks they present. Ensure controls are adequate
    to reasonably protect the bank from money laundering and terrorist
    financing.

2.  From the volume of sales and the number of locations that monetary
    instruments are sold, determine whether the bank appropriately
    manages the risk associated with monetary instrument sales.

3.  Determine whether the bank's system for monitoring monetary
    instruments for suspicious activities, and for reporting suspicious
    activities, is adequate given the bank's volume of monetary
    instrument sales, size, complexity, location, and types of customer
    relationships. Determine whether suspicious activity monitoring and
    reporting systems (either manual or automated) include a review of:

-   Sales of sequentially numbered monetary instruments from the same or
    different purchasers on the same day to the same payee.

-   Sales of monetary instruments to the same purchaser or sales of
    monetary instruments to different purchasers made payable to the
    same remitter.

-   Monetary instrument purchases by noncustomers.

-   Common purchasers, payees, addresses, sequentially numbered
    purchases, and unusual symbols.[^5]

4.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

5.  On the basis of the bank's risk assessment, as well as prior
    examination and audit reports, select a sample of monetary
    instrument transactions for both customers and noncustomers from:

-   Monetary instrument sales records.

-   Copies of cleared monetary instruments purchased with currency.

6.  From the sample selected, analyze transaction information to
    determine whether amounts, the frequency of purchases, and payees
    are consistent with expected activity for customers or noncustomers
    (e.g., payments to utilities, household purchases). Identify any
    suspicious or unusual activity.

7.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with monetary instruments.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Brokered Deposits**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with brokered deposit relationships, and management's ability to
implement effective due diligence, monitoring, and reporting systems.

**PROCEDURES**

1.  Review the policies, procedures, and processes related to deposit
    broker relationships. Evaluate the adequacy of the policies,
    procedures, and processes given the bank's deposit broker activities
    and the risks that they present. Ensure that controls are adequate
    to reasonably protect the bank from money laundering and terrorist
    financing.

2.  From a review of management information systems (MIS) and internal
    risk rating factors, determine whether the bank effectively
    identifies and monitors deposit broker relationships, particularly
    those that pose a high risk for money laundering.

3.  Determine whether the bank's system for monitoring deposit broker
    relationships for suspicious activities, and for reporting
    suspicious activities, is adequate given the bank's size,
    complexity, location, and types of customer relationships.

4.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

5.  On the basis of the bank's risk assessment of its brokered deposit
    activities, as well as prior examination and audit reports, select a
    sample of high-risk deposit broker accounts. When selecting a
    sample, examiners should consider the following:

-   New relationships with deposit brokers.

-   The method of generating funds (e.g., Internet brokers).

-   Types of customers (e.g., nonresident or offshore customers,
    politically exposed persons, or foreign shell banks).

-   A deposit broker that has appeared in the bank's Suspicious Activity
    Reports (SARs).

-   Subpoenas served on the bank for a particular deposit broker.

-   Foreign funds providers.

-   Unusual activity.

6.  Review the customer due diligence information on the deposit broker.
    For deposit brokers who are considered high risk (e.g., they solicit
    foreign funds, market via the Internet, or are independent brokers),
    ensure that the following information is available:

[]{.mark}

-   Background and references.

-   Business and marketing methods.

-   Client-acceptance and due diligence practices.

-   The method for or basis of the broker's compensation or bonus
    program.

-   The broker's source of funds.

-   Anticipated activity or transaction types and levels (e.g., funds
    transfers).

7.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with deposit brokers.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Privately-Owned Automated Teller
Machines**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with privately-owned automated teller machines (ATMs) and Independent
Sales Organization (ISO) relationships, and management's ability to
implement effective due diligence, monitoring, and reporting systems.

**PROCEDURES**

1.  Review the policies, procedures, and processes related to
    privately-owned ATM accounts. Evaluate the adequacy of the policies,
    procedures, and processes given the bank's privately-owned ATM and
    ISO relationships and the risk they present. Ensure that controls
    are adequate to reasonably protect the bank from money laundering
    and terrorist financing.

2.  From a review of management information systems (MIS) and internal
    risk rating factors, determine whether the bank effectively
    identifies and monitors privately-owned ATM accounts.

3.  Determine whether the bank's system for monitoring privately-owned
    ATM accounts for suspicious activities, and for reporting suspicious
    activities, is adequate given the bank's size, complexity, location,
    and types of customer relationships.

4.  Determine whether the bank sponsors network membership for ISOs. If
    the bank is a sponsoring bank, review contractual agreements with
    networks and the ISOs to determine whether due diligence procedures
    and controls are designed to ensure that ISOs are in compliance with
    network rules.

**TRANSACTION TESTING**

5.  On the basis of the bank's risk assessment of its privately-owned
    ATM and ISO relationships, as well as prior examination and audit
    reports, select a sample of privately-owned ATM accounts. From the
    sample selected, perform the following procedures:

-   Review the bank's customer due diligence (CDD) information.
    Determine whether the information adequately verifies the ISO's
    identity and describes its:

```{=html}
<!-- -->
```
-   Background.

-   Source of funds.

-   Anticipated activity or transaction types and levels (e.g., funds
    transfers).

-   ATMs (size and location).

-   Currency delivery arrangement, if applicable.

```{=html}
<!-- -->
```
-   Review any MIS reports the bank uses to monitor ISO accounts.
    Determine whether the flow of funds or expected activity is
    consistent with the CDD information.

6.  Determine whether a sponsored ISO uses third-party providers or
    servicers to load currency, maintain ATM machines, or solicit
    merchant locations. If yes, review a sample of third-party service
    agreements for proper due diligence and control procedures.

7.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with ISOs.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Nondeposit Investment Products**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with both networking and in-house nondeposit investment products (NDIP),
and management's ability to implement effective monitoring and reporting
systems.

**PROCEDURES**

1.  Review the policies, procedures, and processes related to NDIP.
    Evaluate the adequacy of the policies, procedures, and processes
    given the bank's NDIP activities and the risks they present. Ensure
    that controls are adequate to reasonably protect the bank from money
    laundering and terrorist financing.

2.  If applicable, review contractual arrangements with financial
    service providers. Determine the BSA/AML compliance responsibility
    of each party. Determine whether these arrangements provide for
    adequate BSA/AML oversight.

3.  From a review of management information systems (MIS) reports (e.g.,
    exception reports, funds transfer reports, and activity monitoring
    reports) and internal risk rating factors, determine whether the
    bank effectively identifies and monitors NDIP, particularly those
    that pose a high risk for money laundering.

4.  Determine how the bank includes NDIP sales activities in its
    bank-wide or, if applicable, enterprise-wide BSA/AML aggregation
    systems.

5.  Determine whether the bank's system for monitoring NDIP and for
    reporting suspicious activities is adequate given the bank's size,
    complexity, location, and types of customer relationships.

6.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

If the bank or its majority-owned subsidiary is responsible for the sale
or direct monitoring of NDIP, then examiners should perform the
following transaction testing procedures on customer accounts
established by the bank.

7.  On the basis of the bank's risk assessment of its NDIP activities,
    as well as prior examination and audit reports, select a sample of
    high risk NDIP. From the sample selected, perform the following
    procedures:

-   Review appropriate documentation, including CIP, to ensure that
    adequate due diligence has been performed and appropriate records
    are maintained.

-   Review account statements and, as necessary, specific transaction
    details for:

```{=html}
<!-- -->
```
-   Expected transactions with actual activity.

-   Holdings in excess of the customer's net worth.

-   Irregular trading patterns (e.g., incoming funds transfers to
    purchase securities followed by delivery of securities to another
    custodian shortly thereafter).

```{=html}
<!-- -->
```
-   Determine whether actual activity is consistent with the nature of
    the customer's business and the stated purpose of the account.
    Identify any unusual or suspicious activity.

8.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with NDIP sales activities.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Insurance**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with insurance sales, and management's ability to implement effective
monitoring and reporting systems.

**PROCEDURES**

1.  Review the policies, procedures, and processes related to insurance
    sales. Evaluate the adequacy of the policies, procedures, and
    processes given the bank's insurance sales activities and the risks
    they present. Ensure that controls are adequate to reasonably
    protect the bank from money laundering and terrorist financing.

2.  Review the contracts and agreements for the bank's networking
    arrangements with affiliates, operating subsidiaries, or other
    third-party insurance providers conducting sales activities on bank
    premises on behalf of the bank.

3.  Depending on the bank's responsibilities as set forth in the
    contracts and agreements, review management information systems
    (MIS) reports (e.g., large transaction reports, single premium
    payments, early policy cancellation records, premium overpayments,
    and assignments of claims) and internal risk rating factors.
    Determine whether the bank effectively identifies and monitors
    insurance product sales.

4.  Depending on the bank's responsibilities as set forth in the
    contracts and agreements, determine whether the bank's system for
    monitoring insurance products for suspicious activities, and for
    reporting suspicious activities, is adequate given the bank's size,
    complexity, location, and types of customer relationships.

5.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

If the bank or its majority-owned subsidiary is responsible for the sale
or direct monitoring of insurance, then examiners should perform the
following transaction testing procedures.

6.  On the basis of the bank's risk assessment of its insurance sales
    activities, as well as prior examination and audit reports, select a
    sample of insurance products. From the sample selected, perform the
    following procedures:

-   Review account opening documentation and ongoing due diligence
    information.

-   Review account activity. Compare anticipated transactions with
    actual transactions.

-   Determine whether activity is unusual or suspicious.

7.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with insurance sales.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Concentration Accounts**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with concentration accounts, and management's ability to implement
effective monitoring and reporting systems.

**PROCEDURES**

1.  Review the policies, procedures, and processes related to
    concentration accounts. Evaluate the adequacy of the policies,
    procedures, and processes in relation to the bank's concentration
    account activities and the risks they represent. Ensure that
    controls are adequate to reasonably protect the bank from money
    laundering and terrorist financing.

2.  From a review of management information systems (MIS) and internal
    risk rating factors, determine whether the bank effectively
    identifies and monitors concentration accounts.

3.  Review the general ledger and identify any concentration accounts.
    After discussing concentration accounts with management and
    conducting any additional research needed, obtain and review a list
    of all concentration accounts and the bank's most recent
    reconcilements.

4.  Determine whether the bank's system for monitoring concentration
    accounts for suspicious activities, and for reporting of suspicious
    activities, is adequate given the bank's size, complexity, location,
    and types of customer relationships.

5.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

6.  On the basis of the bank's risk assessment of its concentration
    accounts, as well as prior examination and audit reports, select a
    sample of concentration accounts. From the sample selected, perform
    the following procedures:

-   Obtain account activity reports for selected concentration accounts.

-   Evaluate the activity and select a sample of transactions passing
    through different concentration accounts for further review.

-   Focus on high-risk activity (e.g., funds transfers or monetary
    instruments purchases) and transactions from high-risk
    jurisdictions.

7.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with concentration accounts.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Lending Activities**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with lending activities, and management's ability to implement effective
due diligence, monitoring, and reporting systems.

**PROCEDURES**

1.  Review the policies, procedures, and processes related to lending
    activities. Evaluate the adequacy of the policies, procedures, and
    processes given the bank's lending activities and the risks the
    represent. Ensure that controls are adequate to reasonably protect
    the bank from money laundering and terrorist financing.

2.  From a review of management information systems (MIS) and internal
    risk rating factors, determine whether the bank effectively
    identifies and monitors high risk loan accounts.

3.  Determine whether the bank's system for monitoring loan accounts for
    suspicious activities and for reporting of suspicious activities, is
    adequate given the bank's size, complexity, location, and types of
    customer relationships.

4.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

5.  On the basis of the bank's risk assessment of its lending
    activities, as well as prior examination and audit reports, select a
    sample of high-risk loan accounts. From the sample selected, perform
    the following procedures:

-   Review account opening documentation, including CIP, to ensure that
    adequate due diligence has been performed and that appropriate
    records are maintained.

-   Review, as necessary, loan history.

-   Compare expected transactions with actual activity.

-   Determine whether actual activity is consistent with the nature of
    the customer's business and the stated purpose of the loan. Identify
    any unusual or suspicious activity.

6.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with lending relationships.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Trade Finance Activities**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with trade finance activities, and management's ability to implement
effective due diligence, monitoring, and reporting systems.

**PROCEDURES**

1.  Review the policies, procedures, and processes related to trade
    finance activities. Evaluate the adequacy of the policies,
    procedures, and processes given the bank's trade finance activities
    and the risks they represent. Ensure that controls are adequate to
    reasonably protect the bank from money laundering and terrorist
    financing.

2.  From a review of management information systems (MIS) and internal
    risk rating factors, determine whether the bank effectively
    identifies and monitors trade finance activities, particularly those
    that pose a higher risk for money laundering.

3.  Determine whether the bank's system for monitoring trade finance
    activities for suspicious activities, and for reporting of
    suspicious activities, is adequate given the bank's size,
    complexity, location, and types of customer relationships.

4.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

5.  On the basis of the bank's risk assessment of its trade finance
    activities, as well as prior examination and audit reports, select a
    sample of trade finance accounts. From the sample selected, review
    documentation for unusual and suspicious activities (e.g., letters
    of credit and irregular pricing of goods).

6.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with trade finance activities.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Private Banking**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with private banking activities, and management's ability to implement
effective due diligence, monitoring, and reporting systems. This section
expands the core review of the statutory and regulatory requirements of
private banking in order to provide a broader assessment of the AML
risks associated with this activity.

**PROCEDURES**

1.  Review the policies, procedures, and processes related to private
    banking activities. Evaluate the adequacy of the policies,
    procedures, and processes given the bank's private banking
    activities and the risks they represent. Ensure that controls are
    adequate to reasonably protect the bank from money laundering and
    terrorist financing.

2.  From a review of management information systems (MIS) reports (e.g.,
    customer aggregation, policy exception and missing documentation,
    customer risk classification, unusual accounts activity, and client
    concentrations) and internal risk rating factors, determine whether
    the bank effectively identifies and monitors private banking
    relationships, particularly those that pose a higher risk for money
    laundering.

3.  Determine whether the bank's system for monitoring private banking
    relationships for suspicious activities, and for reporting of
    suspicious activities, is adequate given the bank's size,
    complexity, location, and types of customer relationships.

4.  Review the private banking compensation program. Determine whether
    it includes qualitative measures that are provided to employees to
    comply with account opening and suspicious activity monitoring and
    reporting requirements.

5.  Review the monitoring program the bank uses to oversee the private
    banking relationship manager's personal financial conditions and to
    detect any inappropriate activities.

6.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

7.  On the basis of the bank's risk assessment of its private banking
    activities, as well as prior examination and audit reports, select a
    sample of private banking accounts. The sample should include the
    following types of accounts:

-   Politically exposed persons (PEPs).

-   Private Investment Companies (PICs), international business
    corporations (IBCs), shell corporations, and nominee accounts.

-   Offshore entities.

-   Cash-intensive businesses.

-   Import or export companies.

-   Customers from or doing business in a high-risk geographic location.

-   Customers listed on unusual activity monitoring reports.

-   Customers who have large dollar transactions and frequent funds
    transfers.

8.  From the sample selected, perform the following procedures :

    -   Review account opening documentation and ongoing due diligence
        information.

    -   Review account statements and, as necessary, specific
        transaction details.

    -   Compare expected transactions with actual activity.

    -   Determine whether actual activity is consistent with the nature
        of the customer's business.

    -   Identify any unusual or suspicious activity.

9.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with private banking relationships.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Trust and Asset Management
Services**

**OBJECTIVE**

Assess the adequacy of the bank's policies, procedures, processes, and
systems to manage the risks associated with trust and asset
management[^6] services, and management's ability to implement effective
due diligence, monitoring, and reporting systems.

**PROCEDURES**

If this is a stand-alone trust examination, refer to the core procedures
section "Scoping and Planning" page 170, for comprehensive guidance on
the BSA/AML examination scope. In such instances, the trust examination
may need to cover additional areas, including training, the BSA
compliance officer, independent review, and follow-up items.

1.  Review the policies, procedures, and processes related to trust and
    asset management services. Evaluate the adequacy of the policies,
    procedures, and processes given the bank's trust and asset
    management activities and the risks they represent. Ensure that
    controls are adequate to reasonably protect the bank from money
    laundering and terrorist financing.

2.  Review the bank's procedures for gathering additional identification
    information, when necessary, about the settlor, grantor, trustee, or
    other persons with authority to direct a trustee, and who thus have
    authority or control over the account, in order to establish a true
    identity of the customer.

3.  From a review of management information systems (MIS) and internal
    risk rating factors, determine whether the bank effectively
    identifies and monitors trust and asset management relationships,
    particularly those that pose a high risk for money laundering.

4.  Determine how the bank includes trust and asset management
    relationships in a bank-wide or, if appropriate, enterprise-wide
    BSA/AML aggregation systems.

5.  Determine whether the bank's system for monitoring trust and asset
    management relationships for suspicious activities, and for
    reporting of suspicious activities, is adequate given the bank's
    size, complexity, location, and types of customer relationships.

6.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

7.  On the basis of the bank's risk assessment of its trust and asset
    management relationships, as well as prior examination and audit
    reports, select a sample of high-risk trust and asset management
    services relationships. Include relationships with grantors and
    co-trustees, if they have authority or control, as well as any
    high-risk assets such as Private Investment Companies (PICs) or
    asset protection trusts. From the sample selected, perform the
    following procedures:

-   Review account opening documentation, including the Customer
    Identification Program (CIP), to ensure that adequate due diligence
    has been performed and that appropriate records are maintained.

-   Review account statements and, as necessary, specific transaction
    details. Compare expected transactions with actual activity.

-   Determine whether actual activity is consistent with the nature of
    the customer's business and the stated purpose of the account.

-   Identify any unusual or suspicious activity.

8.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with trust and asset management relationships.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Nonresident Aliens and Foreign
Individuals**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with transactions involving accounts held by nonresident aliens (NRAs)
and foreign individuals, and management's ability to implement effective
due diligence, monitoring, and reporting systems.

**PROCEDURES**

1.  Review the bank's policies, procedures, and processes related to NRA
    and foreign individual accounts. Evaluate the adequacy of the
    policies, procedures, and processes given the bank's nonresident
    alien and foreign individual activities and the risks they
    represent. Ensure that controls are adequate to reasonably protect
    the bank from money laundering and terrorist financing.

2.  From a review of management information systems (MIS) and internal
    risk rating factors determine whether the bank effectively
    identifies and monitors high risk NRA and foreign individual
    accounts.

3.  Determine whether the bank's system of monitoring NRA and foreign
    individual accounts for suspicious activities, and for reporting of
    suspicious, activities is adequate on the basis of the complexity of
    the bank's NRA and foreign individual relationships, the types of
    products used by NRAs and foreign individuals, the home countries of
    the NRAs, and the source of funds and wealth for NRAs and foreign
    individuals.

4.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

5.  On the basis of the bank's risk assessment of its NRA and foreign
    individual accounts, as well as prior examination and audit reports,
    select a sample of high-risk NRA accounts. Include the following
    risk factors:

-   An account for resident or citizen of a high-risk jurisdiction.

-   Account activity is substantially currency based.

-   An NRA or foreign individual who uses a wide range of bank services,
    particularly correspondent services.

-   An NRA or foreign individual for whom the bank has filed a
    Suspicious Activity Report (SAR).

6.  From the sample selected, perform the following procedures:

-   Review the customer due diligence information, including Customer
    Identification Program information, if applicable.

-   Review account statements and, as necessary, transaction details to
    determine whether actual account activity is consistent with
    expected activity. Assess whether transactions appear unusual or
    suspicious.

-   For W-8 accounts, verify that appropriate forms have been completed
    and updated, as necessary. Review transaction activity and identify
    patterns that indicate U.S. resident status or indicate other
    unusual and suspicious activity.

7.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with NRA accounts.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Politically Exposed Persons**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with transactions involving politically exposed persons (PEPs), and
management's ability to implement effective due diligence, monitoring,
and reporting systems.

**PROCEDURES**

1.  Review the policies, procedures, and processes related to PEPs.
    Evaluate the adequacy of the policies, procedures, and processes
    given the bank's PEP activities and the risks they present. Ensure
    that controls are adequate to reasonably protect the bank from money
    laundering and terrorist financing.

2.  Review the procedures for opening PEP accounts. Identify senior
    management's role in the approval and ongoing monitoring of PEP
    accounts.

3.  From a review of management information systems (MIS) and internal
    risk rating factors, determine whether the bank effectively
    identifies and monitors PEP relationships, particularly those that
    pose a high risk for money laundering.

4.  Determine whether the bank's system for monitoring PEPs for
    suspicious activities, and for reporting of suspicious activities,
    is adequate given the bank's size, complexity, location, and types
    of customer relationships.

5.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

6.  On the basis of the bank's risk assessment of its PEP relationships,
    as well as prior examination and audit reports, select a sample of
    PEP accounts. From the sample selected, perform the following
    procedures:

-   Determine compliance with regulatory requirements and with the
    bank's established policies, procedures, and processes.

-   Review transaction activity for accounts selected. If necessary,
    request and review specific transactions.

-   If the analysis of activity and customer due diligence information
    raises concerns, hold discussions with bank management.

7.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with PEPs.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Embassy and Foreign Consulate
Accounts**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with transactions involving embassy and foreign consulate accounts, and
management's ability to implement effective due diligence, monitoring,
and reporting systems.

**PROCEDURES**

1.  Review the policies, procedures, and processes related to embassy
    and foreign consulate accounts. Evaluate the adequacy of the
    policies, procedures, and processes given the bank's embassy and
    foreign consulate accounts and the risks they present (e.g., number
    of accounts, volume of activity, and geographic locations). Ensure
    that controls are adequate to reasonably protect the bank from money
    laundering and terrorist financing.

2.  Identify senior management's role in the approval and ongoing
    monitoring of embassy and foreign consulate accounts. Determine
    whether the board is aware of embassy banking activities and whether
    it receives periodic reports on these activities.

3.  From a review of management information systems (MIS) and internal
    risk rating factors, determine whether the bank effectively
    identifies and monitors embassy and foreign consulate accounts,
    particularly those that pose a high risk for money laundering.

4.  Determine whether the bank's system for monitoring embassy and
    foreign consulate accounts for suspicious activities, and for
    reporting of suspicious activities, is adequate given the bank's
    size, complexity, location, and types of customer relationships.

5.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

6.  On the basis of the bank's risk assessment of its embassy and
    foreign consulate accounts, as well as prior examination and audit
    reports, select a sample of embassy and foreign consulate accounts.
    From the sample selected, perform the following procedures:

-   Determine compliance with regulatory requirements and with the
    bank's established policies, procedures, and processes.

-   Review the documentation authorizing the ambassador or the foreign
    consulate to conduct banking in the United States.

-   Review transaction activity for accounts selected. If necessary,
    request and review specific transactions.

7.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with embassy and foreign consulate accounts.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Non-Bank Financial Institutions**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with accounts of non-bank financial institutions (NBFIs), and
management's ability to implement effective monitoring and reporting
systems.

**PROCEDURES**

1.  Determine the extent of the bank's relationships with NBFIs and, for
    banks with significant relationships with NBFIs, review the bank's
    risk assessment of this activity.

2.  Review the policies, procedures, and processes related to NBFI
    accounts. Evaluate the adequacy of the policies, procedures, and
    processes given the bank's NBFI activities and the risks they
    represent. Ensure that controls are adequate to reasonably protect
    the bank from money laundering and terrorist financing.

3.  From review of management information systems (MIS) and internal
    risk rating factors, determine whether the bank effectively
    identifies and monitors NBFI accounts.

4.  Determine whether the bank's system for monitoring NBFI accounts for
    suspicious activities, and for reporting of suspicious activities,
    is adequate given the bank's size, complexity, location, and types
    of customer relationships.

**Money Services Businesses**

5.  Consistent with the interagency guidance released on April 26, 2005,
    determine if the bank has policies, procedures, and processes in
    place for accounts opened or maintained for money services
    businesses to:

-   Confirm FinCEN registration, if required.

-   Confirm state licensing, if applicable.

-   Confirm agent status, if applicable.

-   Conduct a risk assessment to determine the level of risk associated
    with each account and whether further due diligence is required.

6.  Determine whether the bank's policies, procedures, and processes to
    assess risks posed by money services business customers effectively
    identify higher risk accounts and the amount of further due
    diligence necessary.

**TRANSACTION TESTING**

7.  On a basis of the bank's risk assessment of its NBFI accounts, as
    well as prior examination and audit reports, select a sample of
    high-risk NBFI accounts. From the sample selected, perform the
    following procedures:

-   Review account opening documentation and ongoing due diligence
    information.

-   Review account statements and, as necessary, specific transaction
    details. Compare expected transactions with actual activity.

-   Determine whether actual activity is consistent with the nature of
    the customer's business and identify any unusual or suspicious
    activity.

8.  On a basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with NBFI relationships.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Professional Service Providers**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with professional service provider relationships, and management's
ability to implement effective due diligence, monitoring, and reporting
systems.

**PROCEDURES**

1.  Review the policies, procedures, and processes related to
    professional service provider relationships. Evaluate the adequacy
    of the policies, procedures, and processes given the bank's
    relationships with professional service providers and the risks
    these relationships represent. Ensure that controls are adequate to
    reasonably protect the bank from money laundering and terrorist
    financing.

2.  From a review of management information systems (MIS) and internal
    risk rating factors, determine whether the bank effectively
    identifies and monitors professional service provider relationships.
    (MIS reports should include information about an entire
    relationship. For example, an interest on lawyers' trust account
    (IOLTA) may be in the name of the law firm instead of an individual.
    However, the bank's relationship report should include the law
    firm's account *and* the names and accounts of lawyers associated
    with the IOLTA.)

3.  Determine whether the bank's system for monitoring professional
    service provider relationship's suspicious activities, and for
    reporting of suspicious activities, is adequate given the bank's
    size, complexity, location, and types of customer relationships.

4.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

5.  On the basis of the bank's risk assessment of its relationships with
    professional service providers, as well as prior examination and
    audit reports, select a sample of high-risk relationships. From the
    sample selected, perform the following procedures:

-   Review account opening documentation and a sample of transaction
    activity.

-   Determine whether actual account activity is consistent with
    anticipated (as documented) account activity. Look for trends in the
    nature, size, or scope of the transactions, paying particular
    attention to currency transactions.

-   Determine whether ongoing monitoring is sufficient to identify
    potentially suspicious activity.

6.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with professional service provider
    relationships.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Non-Governmental Organizations and
Charities**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with accounts of non-governmental organizations (NGOs) and charities,
and management's ability to implement effective due diligence,
monitoring, and reporting systems.

**PROCEDURES**

1.  Review the policies, procedures, and processes related to NGOs.
    Evaluate the adequacy of the policies, procedures, and processes
    given the bank's NGOs accounts and the risks they represent. Ensure
    that controls are adequate to reasonably protect the bank from money
    laundering and terrorist financing.

2.  From a review of management information systems (MIS) and internal
    risk rating factors, determine whether the bank effectively
    identifies and monitors high-risk NGO accounts.

3.  Determine whether the bank's system for monitoring NGO accounts for
    suspicious activities, and for reporting of suspicious activities,
    is adequate given the bank's size, complexity, location, and types
    of customer relationships.

4.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

5.  On the basis of the bank's risk assessment, its NGO and charity
    accounts, as well as prior examination and audit reports, select a
    sample of high-risk NGO accounts. From the sample selected, perform
    the following procedures:

-   Review account opening documentation and ongoing due diligence
    information.

-   Review account statements and, as necessary, specific transaction
    details.

-   Compare expected transactions with actual activity.

-   Determine whether actual activity is consistent with the nature of
    the customer's business.

-   Identify any unusual or suspicious activity.

6.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with NGO accounts.

**BANK SECRECY ACT/ANTI-MONEY LAUNDERING EXAMINATION MANUAL**

**Expanded Examination Procedures -- Corporate Entities (Domestic and
Foreign)**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with transactions involving domestic and foreign corporate entities, and
management's ability to implement effective due diligence, monitoring,
and reporting systems.

**PROCEDURES**

1.  Review the bank's policies, procedures, and processes related to
    corporate entities. Evaluate the adequacy of the policies,
    procedures, and processes given the bank's transactions with
    corporate entities and the risks they present. Ensure that controls
    are adequate to reasonably protect the bank from money laundering
    and terrorist financing.

2.  Review the policies and processes for opening and monitoring
    accounts with corporate entities. Determine whether the policies
    adequately assess the risk between different account types. For
    example, determine whether policies differentiate between U.S.
    corporate entities and foreign corporate entities.

3.  Determine how the bank identifies and, as necessary, completes
    additional due diligence on corporate entities. Assess the level of
    due diligence the bank performs when conducting its risk assessment.

4.  From a review of management information systems (MIS) and internal
    risk rating factors, determine whether the bank effectively
    identifies and monitors high-risk corporate entity accounts.

5.  Determine whether the bank's system for monitoring corporate
    entities for suspicious activities and for reporting of suspicious
    activities, is adequate given the activities associated with
    corporate entities.

6.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

7.  On the basis of the bank's risk assessment of its accounts with
    corporate entities, as well as prior examination and audit reports,
    select a sample of these accounts. Include the following risk
    factors:

-   An entity incorporated in a high-risk jurisdiction.

-   Account activity that is substantially currency based.

-   An entity whose account activity consists primarily of
    circular-patterned funds transfers.

-   A corporate entity whose bearer shares are not under bank or trusted
    third-party control.

-   An entity that uses a wide range of bank services, particularly
    trust and correspondent services.

-   An entity owned or controlled by other nonpublic corporate entities.

-   Corporate entities for which the bank has filed SARs.

8.  From the sample selected, obtain a relationship report for each
    selected account. It is critical that the full relationship, rather
    than only an individual account, be reviewed.

9.  Review the due diligence information on the corporate entity. Assess
    the adequacy of that information.

10. Review account statements and, as necessary, specific transaction
    details. Compare expected transactions with actual activity.
    Determine whether actual activity is consistent with the nature and
    stated purpose of the account and whether transactions appear
    unusual or suspicious. Areas that may pose a high risk such as funds
    transfers, private banking, trust, and monetary instruments, should
    be a primary focus of the transaction review.

11. On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with corporate entity relationships.

**PROCEDURES FOR EVALUATING BANK SECRECY ACT ANTI-MONEY LAUNDERING
COMPLIANCE**

**Expanded Examination Procedures -- Cash-Intensive Businesses**

**OBJECTIVE**

Assess the adequacy of the bank's systems to manage the risks associated
with cash-intensive businesses and entities, and management's ability to
implement effective due diligence, monitoring, and reporting systems.

**PROCEDURES**

1.  Review the policies, procedures, and processes related to
    cash-intensive businesses. Evaluate the adequacy of policies,
    procedures, and processes given the bank's cash-intensive business
    activities in relation to the bank's cash-intensive business
    customers and the risks that they represent. Ensure that controls
    are adequate to reasonably protect the bank from money laundering
    and terrorist financing.

2.  From a review of management information systems (MIS) and internal
    risk rating factors, determine whether the bank effectively
    identifies and monitors cash-intensive businesses and entities.

3.  Determine whether the bank's system for monitoring cash-intensive
    businesses for suspicious activities, and for reporting of
    suspicious activities, is adequate given the bank's size,
    complexity, location, and types of customer relationships.

4.  If appropriate, refer to the "Office of Foreign Assets Control"
    procedures on page 207.

**TRANSACTION TESTING**

5.  On the basis of the bank's risk assessment of its cash-intensive
    business and entity relationships, as well as prior examination and
    audit reports, select a sample of cash-intensive businesses. From
    the sample selected, perform the following procedures:

-   Review account opening documentation including Customer
    Identification Program information, if applicable, and a sample of
    transaction activity.

-   Determine whether actual account activity is consistent with
    anticipated account activity.

-   Look for trends in the nature, size, or scope of the transactions,
    paying particular attention to currency transactions.

-   Determine whether ongoing monitoring is sufficient to identify
    potentially suspicious activity.

6.  On the basis of procedures completed, including transaction testing,
    form a conclusion about the adequacy of policies, procedures, and
    processes associated with cash-intensive businesses and entities.

[^1]: The lead financial institution is the largest financial
    institution in the holding company structure in terms of assets
    unless otherwise designated by the holding company.

[^2]: Bank holding companies (BHCs) or any non-bank subsidiary thereof,
    or a foreign bank that is subject to the BHC Act or any non-bank
    subsidiary of such a foreign bank operating in the United States to
    file a SAR with the appropriate federal law enforcement agencies and
    the U.S. Treasury, as required by 12 CFR 225.4(f). Certain savings
    and loan holding companies, and their non-depository subsidiaries,
    are required to file SARs pursuant to Treasury regulations. In
    addition, savings and loan holding companies, if not required, are
    strongly encouraged to file SARs in appropriate circumstances.

[^3]: Refer to core procedures section "International Transportation of
    Currency or Monetary Instruments Reporting," on page 206 for
    additional guidance.

[^4]: This includes affiliates and subsidiaries.

[^5]: Money launderers are known to identify the ownership or source of
    illegal funds through the use of unique and unusual stamps.

[^6]: Asset management accounts can be trust or agency accounts and are
    managed by the bank.