Bank Secrecy Act/Anti-Money Laundering Checklist

+------------------------------------------+-------+-------------------+
|                                          | **Yes | **Comments**      |
|                                          | /No** |                   |
+------------------------------------------+-------+-------------------+
| #                                        |       |                   |
|  Bank Secrecy Act (BSA) \[12 CFR 21.21\] |       |                   |
+------------------------------------------+-------+-------------------+
| BSA Compliance Program \[12 CFR 21.21    |       |                   |
| (b) (1) (2)\]                            |       |                   |
|                                          |       |                   |
| -   A written program.                   |       |                   |
|                                          |       |                   |
| -   Board Approved.                      |       |                   |
|                                          |       |                   |
| -   Documented within Board minutes.     |       |                   |
|                                          |       |                   |
| Includes Customer Identification Program |       |                   |
| (CIP)                                    |       |                   |
|                                          |       |                   |
| (Does program address all BSA related    |       |                   |
| areas (e.g. CTRs, SAR,) and high money   |       |                   |
| laundering risk areas).                  |       |                   |
+------------------------------------------+-------+-------------------+
| 1\. Internal Controls \[12 CFR           |       |                   |
| 21.21(c)(1)\]                            |       |                   |
|                                          |       |                   |
| -   Comprehensive (account opening,      |       |                   |
|     suspicious activity monitoring and   |       |                   |
|     reporting, currency reporting, and   |       |                   |
|     other BSA record keeping policies    |       |                   |
|     and procedures).                     |       |                   |
|                                          |       |                   |
| -   Management / Board reporting to      |       |                   |
|     ensure ongoing compliance.           |       |                   |
|                                          |       |                   |
| -   Dual control and segregation of      |       |                   |
|     duties.                              |       |                   |
|                                          |       |                   |
| -   Risk-based customer due diligence.   |       |                   |
+------------------------------------------+-------+-------------------+
| 2\. Independent Testing (internal or     |       |                   |
| external) \[12 CFR 21.21(c)(2)\]         |       |                   |
|                                          |       |                   |
| -   Attests to overall integrity /       |       |                   |
|     effectiveness of management systems  |       |                   |
|     and controls, and BSA technical      |       |                   |
|     compliance (31 CFR 103)              |       |                   |
|                                          |       |                   |
| -   Tests transactions in all areas with |       |                   |
|     emphasis on high-risk areas,         |       |                   |
|     products, services, customers, and   |       |                   |
|     geographic locations.                |       |                   |
|                                          |       |                   |
| -   Assesses employees' knowledge of     |       |                   |
|     regulations and procedures.          |       |                   |
|                                          |       |                   |
| -   Assesses adequacy, accuracy, and     |       |                   |
|     completeness of training programs.   |       |                   |
|                                          |       |                   |
| -   Assesses adequacy of the bank's      |       |                   |
|     process for identifying suspicious   |       |                   |
|     activity.                            |       |                   |
|                                          |       |                   |
| -   Assesses timely reporting of         |       |                   |
|     appropriate issues to Board and      |       |                   |
|     senior management.                   |       |                   |
|                                          |       |                   |
| ```{=html}                               |       |                   |
| <!-- -->                                 |       |                   |
| ```                                      |       |                   |
| -   Ensures the development of effective |       |                   |
|     corrective action programs, as       |       |                   |
|     necessary.                           |       |                   |
+------------------------------------------+-------+-------------------+
| 3\. Designated BSA Officer responsible   |       |                   |
| for coordinating and monitoring          |       |                   |
| day-to-day compliance. \[12 CFR          |       |                   |
| 21.21(c)(3)\]                            |       |                   |
|                                          |       |                   |
| -   Designated by the Board.             |       |                   |
|                                          |       |                   |
| ```{=html}                               |       |                   |
| <!-- -->                                 |       |                   |
| ```                                      |       |                   |
| -   Qualified / fully knowledgeable of   |       |                   |
|     BSA.                                 |       |                   |
|                                          |       |                   |
| -   Reports BSA/AML compliance issues to |       |                   |
|     senior managers and board of         |       |                   |
|     directors.                           |       |                   |
|                                          |       |                   |
| -   Given sufficient authority and       |       |                   |
|     resources.                           |       |                   |
+------------------------------------------+-------+-------------------+
| 4\. Training \[12 CFR 21.21(c)(4)\]      |       |                   |
|                                          |       |                   |
| -   The training program includes:       |       |                   |
|                                          |       |                   |
|     -   Content.                         |       |                   |
|                                          |       |                   |
|     -   Employee coverage.               |       |                   |
|                                          |       |                   |
|     -   Attendance.                      |       |                   |
|                                          |       |                   |
|     -   Frequency.                       |       |                   |
+------------------------------------------+-------+-------------------+
| **Bank Secrecy Act (BSA) \[31 CFR        |       |                   |
| 103.\]**                                 |       |                   |
+------------------------------------------+-------+-------------------+
| **BSA REPORTING REQUIREMENTS:**          |       |                   |
+------------------------------------------+-------+-------------------+
| Suspicious Activity Reports (SARs) --    |       |                   |
| Form 90-22.47 \[31 CFR 103.18 / 12 CFR   |       |                   |
| 21.11\]                                  |       |                   |
|                                          |       |                   |
| -   File SARs with FinCEN in the         |       |                   |
|     following circumstances:             |       |                   |
|                                          |       |                   |
|     -   Insider abuse involving any      |       |                   |
|         amount                           |       |                   |
|                                          |       |                   |
|     -   Violations aggregating \$5,000   |       |                   |
|         or more where a suspect can be   |       |                   |
|         identified                       |       |                   |
|                                          |       |                   |
|     -   Violations aggregating \$25,000  |       |                   |
|         or more regardless of potential  |       |                   |
|         suspects                         |       |                   |
|                                          |       |                   |
|     -   Transactions aggregating \$5,000 |       |                   |
|         or more that involve potential   |       |                   |
|         money laundering or violate the  |       |                   |
|         BSA.                             |       |                   |
|                                          |       |                   |
| -   File a SAR no later than 30 days     |       |                   |
|     after the date of                    |       |                   |
|     [initial]{.underline} detection of   |       |                   |
|     facts that constitute a basis for    |       |                   |
|     filing. If no suspect is identified, |       |                   |
|     a NB may delay in filing an          |       |                   |
|     additional 30 days. In no case delay |       |                   |
|     filing greater than 60 days. \[31    |       |                   |
|     CFR 103.18(b)(3) / 12 CFR 21.11(d)\] |       |                   |
|                                          |       |                   |
| -   Record Retention -- maintain a coy   |       |                   |
|     of the original SAR filed and the    |       |                   |
|     supporting documentation for 5       |       |                   |
|     years. \[31 CFR 103.18(d) / 12 CFR   |       |                   |
|     21.11(g)\]                           |       |                   |
|                                          |       |                   |
| -   Notification to Board of Directors.  |       |                   |
|     \[12 CFR 21.11(h)\]                  |       |                   |
+------------------------------------------+-------+-------------------+
| Currency Transactions Reports (CTRs) --  |       |                   |
| FinCEN Form 104 \[31 CFR 103.22\]        |       |                   |
|                                          |       |                   |
| -   System in place for identifying cash |       |                   |
|     transactions aggregating more than   |       |                   |
|     \$10,000 on the same day by (or on   |       |                   |
|     behalf of) the same individual or by |       |                   |
|     account to ensure that a CTR is      |       |                   |
|     filed within the required time       |       |                   |
|     frame.                               |       |                   |
|                                          |       |                   |
|     -   Manual System                    |       |                   |
|                                          |       |                   |
|     -   Automated System                 |       |                   |
|                                          |       |                   |
| -   Files CTRs within required           |       |                   |
|     timeframes (15 days).                |       |                   |
+------------------------------------------+-------+-------------------+
| Designation of Exempt Person -- Form TDF |       |                   |
| 90-22.53 \[31 CFR 103.22(d)\]            |       |                   |
|                                          |       |                   |
| -   Exempt customers are designated in   |       |                   |
|     accordance with the requirements.    |       |                   |
|     \[31 CFR 103.22 (d)(2) and 31 CFR    |       |                   |
|     103.22 (d)(3)\]                      |       |                   |
|                                          |       |                   |
| -   Bank reviews and verifies            |       |                   |
|     information concerning exemptions at |       |                   |
|     least annually \[31 CFR              |       |                   |
|     103.22(d)(4)\] and biennial filings  |       |                   |
|     are performed on required accounts   |       |                   |
|     \[31 CFR 103.22 (d)(5)\].            |       |                   |
|                                          |       |                   |
| -   Bank adequately monitors exempt      |       |                   |
|     persons for suspicious activity.     |       |                   |
|     \[31 CFR 103.22(d)(9)(ii)\]          |       |                   |
|                                          |       |                   |
| -   Exemptions are revoked when they no  |       |                   |
|     longer meet the regulatory criteria. |       |                   |
|     \[31 CFR 103.22(d)(8)\]              |       |                   |
+------------------------------------------+-------+-------------------+
| Report of International Transportation   |       |                   |
| of Currency or Monetary Instruments      |       |                   |
| (CMIR) -- FinCEN Form 105 Formerly       |       |                   |
| Customs Form 4790 \[31 CFR 103.23\]      |       |                   |
|                                          |       |                   |
| -   Bank files a CMIR for each shipment, |       |                   |
|     except by common carrier, of         |       |                   |
|     currency or other monetary           |       |                   |
|     instrument(s) in excess of \$10,000  |       |                   |
|     from the U.S. or into the U.S., by,  |       |                   |
|     or to the bank. \[31 CFR 103.23(a)   |       |                   |
|     and (b)\] (In most cases, this       |       |                   |
|     refers to the bank's cash            |       |                   |
|     shipments.)                          |       |                   |
+------------------------------------------+-------+-------------------+
| Report of Foreign Bank and Financial     |       |                   |
| Accounts (FBAR) TD F 90-22.1 \[31 CFR    |       |                   |
| 103.24\]                                 |       |                   |
|                                          |       |                   |
| -   Report by persons having a financial |       |                   |
|     interest in, or signature or other   |       |                   |
|     authority over, a bank, securities   |       |                   |
|     or other financial account in a      |       |                   |
|     foreign country to IRS each year of  |       |                   |
|     its existence.                       |       |                   |
|                                          |       |                   |
| -   Persons having a financial interest  |       |                   |
|     in 25 or more financial accounts     |       |                   |
|     need only note this fact on form.    |       |                   |
|                                          |       |                   |
| -   Bank files report within the         |       |                   |
|     required time frame.                 |       |                   |
+------------------------------------------+-------+-------------------+
| **BSA REGULATORY REQUIREMENTS**          |       |                   |
+------------------------------------------+-------+-------------------+
| Information sharing between Law          |       |                   |
| Enforcement and Financial Institutions   |       |                   |
| -- \[31 CFR 103.100\]                    |       |                   |
|                                          |       |                   |
| -   Ability to receive information       |       |                   |
|     requests.                            |       |                   |
|                                          |       |                   |
| -   Policies and procedures are in place |       |                   |
|     to process information requests.     |       |                   |
|     Procedures should include:           |       |                   |
|                                          |       |                   |
|     -   Guidance on reporting to FinCEN  |       |                   |
|         if the bank identifies an        |       |                   |
|         account or transaction requested |       |                   |
|         \[31 CFR 103.100(b)(2)(ii);      |       |                   |
|                                          |       |                   |
|     -   The designation of a contact     |       |                   |
|         person. \[31 CFR                 |       |                   |
|         103.100(b)(2)(iii)\]; and        |       |                   |
|                                          |       |                   |
|     -   Protects the security and        |       |                   |
|         confidentiality of requests from |       |                   |
|         FinCEN \[31 CFR                  |       |                   |
|         103.100(b)(2)(iv)(C)             |       |                   |
|                                          |       |                   |
| -   Bank systems are capable to perform  |       |                   |
|     record searches on:                  |       |                   |
|                                          |       |                   |
|     -   Current accounts \[31 CFR        |       |                   |
|         103.100(b)(2)(i)(A)\];           |       |                   |
|                                          |       |                   |
|     -   Accounts maintained during the   |       |                   |
|         preceding 12 months \[31 CFR     |       |                   |
|         103.100(b)(2)(i)(B)\]; and,      |       |                   |
|                                          |       |                   |
|     -   Any transaction or transmittal   |       |                   |
|         in which a named suspect was     |       |                   |
|         either the transmitter or        |       |                   |
|         recipient during the preceding   |       |                   |
|         six months \[31 CFR              |       |                   |
|         103.100(b)(2)(i)(C)\].           |       |                   |
+------------------------------------------+-------+-------------------+
| Voluntary Information sharing --\[31 CFR |       |                   |
| 103.110\]                                |       |                   |
|                                          |       |                   |
| -   Policies and procedures in place to  |       |                   |
|     process information shared among     |       |                   |
|     institutions, including procedures   |       |                   |
|     to safeguard the security and        |       |                   |
|     confidentiality of such information  |       |                   |
|     \[31 CFR 103.110(b)(1) -- (5)\].     |       |                   |
|                                          |       |                   |
| -   The bank has submitted an annual     |       |                   |
|     notice to FinCEN \[31 CFR            |       |                   |
|     103.110(b)(2)\]                      |       |                   |
|                                          |       |                   |
| -   Has verified the financial           |       |                   |
|     institution it intends to share      |       |                   |
|     information with has filed notice    |       |                   |
|     with FinCEN. \[31 CFR                |       |                   |
|     103.110(b)(3)\]                      |       |                   |
+------------------------------------------+-------+-------------------+
| Foreign correspondent account            |       |                   |
| recordkeeping and due diligence \[31 CFR |       |                   |
| 103.177, 103.185 \]                      |       |                   |
|                                          |       |                   |
| -   Prohibit dealings with foreign shell |       |                   |
|     banks.                               |       |                   |
|                                          |       |                   |
| -   Sufficient internal controls.        |       |                   |
+------------------------------------------+-------+-------------------+
| Customer Identification Program (CIP)    |       |                   |
| \[31 CFR 103.121\]                       |       |                   |
|                                          |       |                   |
| -   CIP implemented as part of the BSA   |       |                   |
|     compliance program \[12 CFR          |       |                   |
|     21.21(b)(2)\]                        |       |                   |
|                                          |       |                   |
| -   The CIP has account opening          |       |                   |
|     procedures that includes:            |       |                   |
|                                          |       |                   |
|     -   Obtaining the minimum            |       |                   |
|         information. \[31 CFR            |       |                   |
|         103.121(b)(2)(i)\]               |       |                   |
|                                          |       |                   |
|     -   Customer verification. \[31 CFR  |       |                   |
|         103.121(b)(2)(ii)\]              |       |                   |
|                                          |       |                   |
|     -   Recordkeepiong requirements and  |       |                   |
|         Retention. \[31 CFR              |       |                   |
|         103.121(b)(3)\]                  |       |                   |
|                                          |       |                   |
|     -   Comparison with government       |       |                   |
|         lists. \[31 CFR 103.121(b)(4)\]  |       |                   |
|                                          |       |                   |
|     -   Adequate customer notice. \[31   |       |                   |
|         CFR 103.121(b)(5)\]              |       |                   |
|                                          |       |                   |
|     -   Reliance on another financial    |       |                   |
|         institution. \[31 CFR            |       |                   |
|         103.121(b)(6)\]                  |       |                   |
+------------------------------------------+-------+-------------------+

+------------------------------------------+-------+-------------------+
| **BSA RECORDKEEPING REQUIREMENTS:**      |       |                   |
+------------------------------------------+-------+-------------------+
| Monetary Instrument Sales Records \[31   |       |                   |
| CFR 103.29\]                             |       |                   |
|                                          |       |                   |
| -   Procedures are in place for          |       |                   |
|     identifying information for the      |       |                   |
|     sale/purchase of monetary            |       |                   |
|     instruments for cash in amounts      |       |                   |
|     between \$3,000 and \$10,000         |       |                   |
|     inclusive.                           |       |                   |
+------------------------------------------+-------+-------------------+
| Funds Transfer Record Keeping and Travel |       |                   |
| Rule Requirements \[31 CFR 103.33(e) and |       |                   |
| (g)\]                                    |       |                   |
|                                          |       |                   |
| -   Procedures are in place for          |       |                   |
|     identifying information for the      |       |                   |
|     origination/receiving of funds       |       |                   |
|     transfers in amounts of \$3,000 or   |       |                   |
|     more.                                |       |                   |
+------------------------------------------+-------+-------------------+
| Additional records to be made and        |       |                   |
| retained by banks \[31 CFR 103.34\]      |       |                   |
|                                          |       |                   |
| -   Within 30 days from when the account |       |                   |
|     is opened secure and maintain a      |       |                   |
|     record of the taxpayer               |       |                   |
|     identification number of the         |       |                   |
|     customer involved. If unable to      |       |                   |
|     secure, within the 30-day period, a  |       |                   |
|     violation will not occur if:         |       |                   |
|                                          |       |                   |
|     -   Bank has made a reasonable       |       |                   |
|         effort to secure such            |       |                   |
|         identification                   |       |                   |
|                                          |       |                   |
|     -   Bank maintains a list containing |       |                   |
|         names, address, and account      |       |                   |
|         numbers of those persons who you |       |                   |
|         were unable to secure the        |       |                   |
|         identification.                  |       |                   |
|                                          |       |                   |
| -   Record retention. Bank retains       |       |                   |
|     either the original, microfilm, or   |       |                   |
|     other copy, or reproduction of the   |       |                   |
|     records required by the BSA for at   |       |                   |
|     least five years. 31 CFR 103.22(d),  |       |                   |
|     103.27(a)(3), 103.29(c),             |       |                   |
|     103.33(a)-(c), 103.34(a)(1)(ii), and |       |                   |
|     103.34(b)(1)-(13)                    |       |                   |
+------------------------------------------+-------+-------------------+

+------------------------------------------+-------+-------------------+
| **Suspicious Activity Reporting          |       |                   |
| Requirements and Anti-Money Laundering   |       |                   |
| Practices**                              |       |                   |
+------------------------------------------+-------+-------------------+
| Suspicious Activity Monitoring:          |       |                   |
|                                          |       |                   |
| -   Systems to identify, research, and   |       |                   |
|     report suspicious activity:          |       |                   |
|                                          |       |                   |
| -   Assigns accountability for           |       |                   |
|     identification, research, and        |       |                   |
|     reporting suspicious activity.       |       |                   |
|                                          |       |                   |
| -   Appropriate guidance for monitoring  |       |                   |
|     and identifying unusual activity.    |       |                   |
|                                          |       |                   |
| -   An adequate transaction monitoring   |       |                   |
|     system is in place for the risk in   |       |                   |
|     the bank.                            |       |                   |
|                                          |       |                   |
| -   Procedures contain adequate guidance |       |                   |
|     for law enforcement request.         |       |                   |
|                                          |       |                   |
| -   Adequacy of SAR decision making      |       |                   |
|     process in place:                    |       |                   |
|                                          |       |                   |
|     -   SAR decisions are documented.    |       |                   |
|                                          |       |                   |
|     -   The process ensures all          |       |                   |
|         applicable information is        |       |                   |
|         evaluated.                       |       |                   |
|                                          |       |                   |
|         -                                |       |                   |
|                                          |       |                   |
| -   Adequacy of on-going monitoring on   |       |                   |
|     continuing activity.                 |       |                   |
|                                          |       |                   |
| > Quality of SARs filed.                 |       |                   |
+------------------------------------------+-------+-------------------+
| ## Monitoring Tools                      |       |                   |
|                                          |       |                   |
| If the bank has an automated system, the |       |                   |
| bank generates a comprehensive report    |       |                   |
| that details all applicable large        |       |                   |
| currency transactions (i.e., all large   |       |                   |
| cash-ins and cash-outs are reflected on  |       |                   |
| the report).                             |       |                   |
+------------------------------------------+-------+-------------------+
| If the bank does not use an automated    |       |                   |
| system, the bank, focusing on high cash  |       |                   |
| volume locations, ensures that           |       |                   |
| transactions are reviewed from all       |       |                   |
| deposit-taking areas of the bank (e.g.,  |       |                   |
| mortgage banking department, private     |       |                   |
| banking department, fiduciary, brokerage |       |                   |
| department, commercial loan department). |       |                   |
+------------------------------------------+-------+-------------------+
| Customer Due Diligence                   |       |                   |
|                                          |       |                   |
| -   CDD Guidelines are commensurate with |       |                   |
|     the bank's BSA/AML risk profile.     |       |                   |
|                                          |       |                   |
| -   Account opening policies,            |       |                   |
|     procedures, and processes are        |       |                   |
|     sufficient to develop an             |       |                   |
|     understanding of normal and expected |       |                   |
|     activities.                          |       |                   |
|                                          |       |                   |
| -   Policies, procedures, and processes  |       |                   |
|     include guidance for enhanced due    |       |                   |
|     diligence for high-risk customers    |       |                   |
|                                          |       |                   |
| -   CDD Guidance ensures current         |       |                   |
|     customer information is maintained.  |       |                   |
+------------------------------------------+-------+-------------------+
| # OFFICE OF FOREI                        |       |                   |
| GN ASSETS CONTROL (OFAC) \[31 CFR 3500\] |       |                   |
+------------------------------------------+-------+-------------------+
| > Bank has performed an adequate OFAC    |       |                   |
| > risk assessment.                       |       |                   |
+------------------------------------------+-------+-------------------+
| > Bank maintains an accurate, current    |       |                   |
| > listing of prohibited countries,       |       |                   |
| > entities, and individuals.             |       |                   |
+------------------------------------------+-------+-------------------+
| > Bank ensures OFAC information is       |       |                   |
| > disseminated to all appropriate        |       |                   |
| > employees, including foreign country   |       |                   |
| > offices.                               |       |                   |
+------------------------------------------+-------+-------------------+
| > Prior to opening an account, or        |       |                   |
| > conducting a transaction, the bank     |       |                   |
| > compares new accounts (e.g., deposit,  |       |                   |
| > loan private banking, trust, discount, |       |                   |
| > or other securities brokerage          |       |                   |
| > transactions), funds transfers, or     |       |                   |
| > other new bank transactions with the   |       |                   |
| > OFAC listings.                         |       |                   |
+------------------------------------------+-------+-------------------+
| > The bank periodically compares         |       |                   |
| > established accounts and other         |       |                   |
| > customer transactions with the current |       |                   |
| > OFAC listing.                          |       |                   |
+------------------------------------------+-------+-------------------+
| > The bank's independent testing of      |       |                   |
| > their OFAC program is adequate.        |       |                   |
+------------------------------------------+-------+-------------------+