Audit Report 

OIG-06-033

FOREIGN ASSETS CONTROL: Assessing OCC’s Examination of 

OFAC Compliance Was Hampered by Limited Documentation 

July 31, 2006 

Office of 

Inspector General 

Department of the Treasury

Contents 

FOREIGN ASSETS CONTROL: Assessing OCC’s Examination of OFAC Compliance 

Was Hampered by Limited Documentation (OIG-06-033) Page i

 

Audit Report............................................................................................... 1 

 Results in Brief.......................................................................................... 2 

 Background .............................................................................................. 3 

Audit Results ............................................................................................ 6 

 Recommendations ..................................................................................... 10 

Appendices 

 Appendix 1: Objective, Scope, and Methodology...................................... 12 

 Appendix 2 Major Contributors to This Report......................................... 14 

 Appendix 3: Bank Secrecy Act/Anti-Money Laundering Examination Manual 

Excerpt/Core Examination Procedures ................................... 15 

 Appendix 4: Management Response ....................................................... 18 

 Appendix 5: Report Distribution.............................................................. 20 

Abbreviations 

 AML Anti-Money Laundering 

 BSA Bank Secrecy Act 

 FFIEC Federal Financial Institutions Examination Council 

 OCC Office of the Comptroller of the Currency 

 OFAC Office of Foreign Assets Control 

 OIG Office of Inspector General 
FOREIGN ASSETS CONTROL: Assessing OCC’s Examination of OFAC Compliance 

 Was Hampered by Limited Documentation (OIG-06-033) Page ii

This page intentionally left blank. 
OIG Audit 

Report

The Department of the Treasury 

Office of Inspector General 

FOREIGN ASSETS CONTROL: Assessing OCC’s Examination of OFAC Compliance 

Was Hampered by Limited Documentation (OIG-06-033) Page 1

 

July 31, 2006 

John C. Dugan 

Comptroller 

Office of the Comptroller of the Currency 

As a follow-up to a previous OIG report,1

 we conducted an audit of the 

Office of Foreign Assets Control’s (OFAC) administration and 

enforcement of economic sanctions against targeted foreign countries, 

individuals, and groups. OFAC acts under presidential wartime and 

national emergency powers, as well as authority granted by specific 

legislation, to impose controls on transactions and freeze foreign assets 

under U.S. jurisdiction. OFAC sanctions are enforced largely by financial 

institutions. Because OFAC is legally limited in its ability to monitor 

financial institutions’ compliance with foreign sanction requirements,2 it 

depends on financial institution regulators, such as the Office of the 

Comptroller of the Currency (OCC), to ensure that financial institutions 

comply with OFAC requirements. Accordingly, as part of our audit, we 

tested regulatory oversight of OFAC compliance for a sample of financial 

institutions to determine whether OFAC’s foreign sanctions programs 

were being effectively administered. This report presents the results of 

our review of OCC compliance examinations. 

We conducted our audit from March 2005 to April 2006 in accordance 

with generally accepted government auditing standards. A more detailed 

description of our objective, scope and methodology is included in 

appendix 1. 

 

1 FOREIGN ASSETS CONTROL: OFAC’s Ability to Monitor Financial Institution Compliance Is Limited 

Due to Legislative Impairments (OIG-02-082, April 26, 2002). 2

 Section 3412 (d) of the Right to Financial Privacy Act (12 U.S.C. 3401) allows supervisory agencies 

to exchange examination information with other supervisory agencies. OFAC is not included in this 

Act’s list of supervisory agencies [§ 3401(7)]. 

 
FOREIGN ASSETS CONTROL: Assessing OCC’s Examination of OFAC Compliance 

 Was Hampered by Limited Documentation (OIG-06-033) Page 2

Results In Brief 

OCC’s examination work papers did not provide assurance that banks 

were adequately reviewing or effectively administering OFAC’s sanctions 

programs. From a sample of 18 OCC examinations conducted in fiscal 

years 2002 through 2005, we found, for every examination, one or more 

instances in which documentation was insufficient to verify that 

examiners adequately assessed OFAC program compliance. Specifically, 

the OCC examination work papers did not always contain sufficient 

documentation to demonstrate that examiners fully assessed 

• bank policies and procedures for its OFAC compliance 

program, 

• bank comparisons of its accounts with OFAC listings, 

• correspondence between the bank and OFAC, and 

• results of internal bank audits for possible OFAC program 

concerns. 

OCC’s policy on supervisory work papers states that examiners should 

generate and retain only those documents necessary to support the scope 

of supervisory activity, significant conclusions, rating changes, or 

changes in risk profile. We believe, however, that this policy makes it 

difficult to assess the adequacy of the review and creates inconsistency 

in how program results are documented. Guidelines recently issued by the 

Federal Financial Institutions Examination Council (FFIEC)3

 should help 

ensure the consistency of examination coverage. 

We are making recommendations to OCC to ensure that (1) the current 

OCC guidelines for OFAC compliance examinations incorporate the 

policies and procedures contained in the FFIEC BSA/AML Examination 

Manual and (2) examiners sufficiently and consistently document the 

work performed so that an independent reviewer can clearly see which 

 

3

 FFIEC, established under title X of the Financial Institutions Regulatory and Interest Rate Control Act 

of 1978, is a formal interagency body empowered to prescribe uniform principles, standards, and report 

forms for the examination of financial institutions by federal regulators. The members of FFIEC, in 

addition to OCC, are the Office of Thrift Supervision, the Federal Deposit Insurance Corporation, the 

Board of Governors of the Federal Reserve System, and the National Credit Union Administration. 
FOREIGN ASSETS CONTROL: Assessing OCC’s Examination of OFAC Compliance 

 Was Hampered by Limited Documentation (OIG-06-033) Page 3

procedures were performed and ascertain the basis for all significant 

conclusions, including changes to regulatory ratings and risk profiles. 

OCC concurred with our recommendations. OCC has replaced its OFAC 

compliance examination procedures with the FFIEC Bank Secrecy 

Act/Anti-Money Laundering Examination Manual. OCC also intends to 

reinforce its documentation expectations with examining staff. 

In OCC’s response to our draft report, the Comptroller stated that OCC 

has taken major steps, individually, and as part of interagency initiatives 

to enhance BSA/AML processes, including OFAC compliance, in the past 

several years. He also said he is committed to these goals and personally 

directed further enhancements to these processes in the fall of 2005. 

Background 

OFAC’s Mission and Sanctions Programs 

The mission of OFAC, an office within the Department of the Treasury, is 

to administer and enforce economic and trade sanctions, based on U.S. 

foreign policy and national security goals, against targeted foreign 

countries, terrorists, international narcotics traffickers, and those engaged 

in activities related to the proliferation of weapons of mass destruction. 

All U.S. persons, including U.S. banks, bank holding companies, and 

nonbank subsidiaries must comply with OFAC regulations. 

OFAC regulations involve blocking accounts and other assets of the 

specified countries, entities, and individuals and rejecting financial 

transactions with specified countries, entities, and individuals. If financial 

institutions fail to block or reject prohibited transactions, OFAC has the 

authority to impose civil monetary penalties against them. 

OFAC sanctions can reach into virtually all areas of banking operations. 

Therefore, banks need to consider all types of transactions, products, and 

services when they conduct risk assessments and establish appropriate 

policies and procedures. 
FOREIGN ASSETS CONTROL: Assessing OCC’s Examination of OFAC Compliance 

 Was Hampered by Limited Documentation (OIG-06-033) Page 4

OCC Role in Ensuring Banks’ Compliance with OFAC Regulations 

The mission of OCC, which charters, regulates, and supervises all U.S. 

national banks, is to ensure a stable and competitive national banking 

system. OCC has the authority to examine banks and take supervisory 

actions against banks that do not comply with laws and regulations or 

that otherwise engage in unsound banking practices. As of 

September 30, 2005, OCC was responsible for regulating and supervising 

1,933 national banks and 51 federal branches of foreign banks in the 

United States. National banks, as of June 30, 2005, held 67 percent 

($5.8 trillion) of the total assets of all U.S. commercial banks. 

It is OCC’s responsibility to ensure that national banks comply with OFAC 

regulations. However, none of the laws that authorize sanctions for OFAC 

violations contain specific language that delegates administrative 

enforcement responsibility to any of the financial institution regulatory 

agencies, including OCC. Consequently, OCC’s OFAC enforcement 

responsibilities fall under its general examination responsibility to ensure 

that banks are following applicable laws and regulations. 

OCC Examination Procedures for OFAC Compliance 

In September 2000, OCC issued the Bank Secrecy Act/Anti-Money 

Laundering Comptroller’s Handbook, which contains procedures for 

reviewing and assessing banks’ OFAC compliance. According to the 

handbook, examiners should do the following: 

• Review all OFAC-related correspondence 

• Evaluate banks’ OFAC policies and procedures 

• Examine internal audits reports and management reviews 

involving OFAC compliance 

• Verify that banks maintained a current and valid OFAC list4

 

4 OFAC periodically publishes a Specially Designated Nationals and Blocked Persons list of individuals 

and companies owned or controlled by, or acting for or on behalf, of targeted countries. The list also 

contains individuals, groups, and entities, such as terrorists and drug traffickers. 
FOREIGN ASSETS CONTROL: Assessing OCC’s Examination of OFAC Compliance 

 Was Hampered by Limited Documentation (OIG-06-033) Page 5

• Determine whether banks have procedures to ensure that new 

and existing accounts and transactions are compared with the 

OFAC list. 

OCC Policies and Procedures Manual 

The Bank Supervision section of the OCC Policies and Procedures Manual, 

dated October 23, 2002, addresses supervision work papers and states 

that the level of detail in work papers should be commensurate with the 

risks facing the institution. In most cases, the work papers need not 

include all of the data reviewed. Instead, the examiner should generate 

and retain only documents necessary to support the scope, significant 

conclusions, rating changes, or changes in a risk profile. Work papers do 

not typically need to address every objective and procedural step. 

FFIEC Core Examination Procedures for OFAC Compliance 

In June 2005, FFIEC released the Bank Secrecy Act/Anti-Money 

Laundering Examination Manual (BSA/AML Examination Manual). The 

manual includes core procedures for examiners to use to determine 

whether financial institutions are in compliance with OFAC sanctions 

programs. (See appendix 3.) According to the BSA/AML Examination 

Manual, financial institutions should use a risk-based approach when 

considering the likelihood of encountering possible OFAC violations. 

The BSA/AML Examination Manual also states that transaction testing5

 is 

a requirement to be accomplished as part of each examination. However, 

examiners are to use transactional testing in high risk areas identified in 

the bank’s risk assessment. If OFAC is deemed a high risk area, the 

 

5 As provided in the BSA/AML Examination Manual, examiners perform transaction testing to evaluate 

the adequacy of the bank’s compliance with regulatory requirements, determine the effectiveness of its 

policies, procedures, and processes, and evaluate suspicious activity monitoring systems. Transaction 

testing, the manual states, is an important factor in forming conclusions about the integrity of the 

bank’s overall controls and risk management processes and must be performed at each examination. 

The extent of transaction testing and activities where it is performed is based on various factors, 

including the examiner’s judgment of risks, controls, and the adequacy of the independent testing by 

the bank’s internal audit function. Once the examiner is on-site, the scope of the transaction testing 

can be expanded to address any issues or concerns identified during the examination. 
FOREIGN ASSETS CONTROL: Assessing OCC’s Examination of OFAC Compliance 

 Was Hampered by Limited Documentation (OIG-06-033) Page 6

examiners may choose to use transaction testing to evaluate the bank’s 

handling of new and established accounts, the effectiveness of interdict 

software if used, the handling of blocked transactions, or the resolution 

of false hits. 

Audit Results 

OCC’s examination work papers lacked sufficient documentation to 

assure that banks were adequately reviewing or administering OFAC 

sanctions programs. Our review of fiscal years 2002-5 examination 

results for the 18 banks revealed instances of inadequate documentation 

for significant examination steps. The following table summarizes the 

results of our review: 

Table 1: Examinations Conducted in Fiscal Years 2002-5 with Insufficient 

Documentation

. 

Source: OIG analysis 

For one examination, OCC did not provide any work papers to support the 

examination’s findings. 

Our efforts to evaluate and verify the examiners’ conclusions were 

hampered by the lack of documentation. If examiners conclude that an 

institution is OFAC-compliant, OCC does not require that documentation 

covering all objectives and procedures as well as copies of bank policy 

documents be maintained and available to support their conclusions. As a 

result, documentation is often not available to allow an external reviewer 

to verify and assess the examiner’s conclusions. OCC management 

prefers that OCC resources be used to document and address conditions 

that result in noncompliance. 

Examination Step Number of Examinations

Assessment of policies and procedures 16

Assessment of effectiveness of bank 

comparisons to OFAC list 13

Review of OFAC correspondence 11

Review of internal bank audit results 9
FOREIGN ASSETS CONTROL: Assessing OCC’s Examination of OFAC Compliance 

 Was Hampered by Limited Documentation (OIG-06-033) Page 7

Description of Our Review 

To assess OCC examinations of banks’ compliance with OFAC 

regulations, we selected a sample of 18 bank examinations that OCC 

conducted in fiscal years 2002 through 2005. For our sample, we 

selected 3 banks that had prior OFAC violations – OFAC had imposed 

civil monetary penalties against 2 of these banks and issued a warning 

letter to the third. 

The remaining 15 banks were selected from a stratified sample of banks 

based on asset size and distributed among the 4 OCC districts (western, 

central, southern, and northeastern). In total, we selected 3 large banks 

(assets from $25 billion to $999 billion), 5 medium banks (assets from $1 

billion to $25 billion), and 10 small banks (assets from $1 million to 

$1 billion). We included 3 banks each from New York, California, and 

Texas as well as 2 banks each in Illinois and Missouri. The remaining 6 

banks were located in New Jersey, Florida, Colorado, Indiana, and West 

Virginia. 

For each of the 18 banks in our sample, we requested copies of the most 

recent OFAC compliance examination work papers. In addition, we 

requested copies of all documentation that may have affected the scope 

of the OFAC reviews.

Banks’ Policies and Procedures for Determining OFAC Compliance Were 

Not Always Documented 

Banks should have policies and procedures to ensure OFAC program 

compliance. For 16 of 18 examinations, OCC examiners reported that 

OFAC compliance was satisfactory, but we were unable either to confirm 

that the policies and procedures existed or to validate the examiners’ 

summaries and conclusions. For 2 examinations, copies of the policies 

and procedures were in the examination work papers. OCC officials 

indicated that examiners need not maintain copies of a bank’s policies 

and procedures and that it is considered sufficient to review them on-site. 
FOREIGN ASSETS CONTROL: Assessing OCC’s Examination of OFAC Compliance 

 Was Hampered by Limited Documentation (OIG-06-033) Page 8

OCC Examinations Lacked Evidence of Assessment of the Effectiveness 

of Bank Comparisons to OFAC List 

In assessing banks’ compliance with OFAC, OCC examiners generally 

note in their work papers the method a banks uses to compare accounts 

and transactions to OFAC lists of countries, entities, and individuals 

whose accounts, assets, or transactions are to be blocked or frozen. OCC 

examiners indicated that 13 of the 18 banks used OFAC interdict 

software to conduct their comparisons, but we did not find any evidence 

that examiners had assessed whether the software was effective or had 

been updated to include the most recent changes to the OFAC list. 

For 2 of the other 5 banks, the examination work papers indicated that 

the banks compared accounts and transactions to the OFAC list 

manually. However, the work papers did not document whether the 

examiners determined if the banks’ manual procedures were effective. For 

the remaining 3 banks, the examination work papers did not specify how 

comparisons were done. 

We also evaluated whether OCC examiners verified that the banks 

compared accounts with the OFAC list. In 3 of the 18 examinations, 

there was no evidence that the examiners completed this procedure. 

Examiners Did Not Always Document Reviews of OFAC-Related 

Correspondence 

One of the initial procedures OCC examiners perform in examining banks’ 

compliance with OFAC is to review any OFAC-related correspondence 

specific to the bank under examination. In 10 of the 18 examinations, 

OCC examiners did not document whether they conducted such a review. 

In 1 examination, the examiner indicated that the correspondence review 

was not conducted. 

For the remaining 7 banks, the examiners documented their examination 

results. Five banks did not have any OFAC-related correspondence to 

review, while 2 banks had copies of issued OFAC penalties and warning 

letters. 
FOREIGN ASSETS CONTROL: Assessing OCC’s Examination of OFAC Compliance 

 Was Hampered by Limited Documentation (OIG-06-033) Page 9

Examiners Did Not Always Document Reviews of Internal Audit Reports 

OCC examiners review banks’ internal audit reports to determine whether 

banks have addressed any weaknesses identified in their OFAC 

compliance program reviews. Examiners’ work papers for 9 of the 18 

examinations contained insufficient evidence for us to determine whether 

the bank conducted internal audits that included a review of OFAC 

compliance. In 7 of these examinations, the banks conducted internal 

audits, but the OCC examiner did not document whether OFAC 

compliance was included in the scope of the audits. In the remaining 2 

examinations, the examiners made no reference as to whether the bank 

had performed any type of internal audit or independent review. 

Conclusions 

The FFIEC BSA/AML Examination Manual provides guidance for ensuring 

that OFAC compliance examinations are uniform, comprehensive, and 

based on valid risk assessments. According to the manual, financial 

institution regulators such as OCC are to examine financial institutions to 

determine the adequacy of each institution’s OFAC program and the 

effectiveness of its risk management. The examiners are to use the 

manual’s appendix M, “Quantity of Risk Matrix—OFAC Procedures,” to 

help determine the OFAC risk level of the institution under review. Based 

on their determination of risk from this matrix, as well as a review of prior 

examination reports and internal audit findings for the institution, the 

examiners are to select which policies and procedures to verify. We 

believe this process should be documented. 

In a November 14, 2005, letter to the chairman of the Senate Committee 

on Banking, Housing and Urban Affairs, the Comptroller of the Currency 

indicated that OCC would change its supervisory process to address the 

increasing risk associated with BSA/AML compliance. Specifically, OCC 

would strengthen its BSA/AML examinations through (1) enhanced risk 

management; (2) application of the uniform examination procedures set 

forth in the BSA/AML Examination Manual, including mandatory 

transaction testing; and (3) timely and effective follow-up. 

The Manual identifies the OFAC-related information that should be 

requested by the examiners in preparing for the examination. In addition, 
FOREIGN ASSETS CONTROL: Assessing OCC’s Examination of OFAC Compliance 

 Was Hampered by Limited Documentation (OIG-06-033) Page 10

the numerous examination procedures and the options available for 

transaction testing will necessitate that examiners exercise care in 

choosing appropriate procedures and transactions for testing. To ensure 

that the results of OFAC examinations are valid and reliable, examiners 

will need to identify the documentation reviewed and the work 

performed. The basis for significant conclusions reached should be 

sufficient to satisfy an independent reviewer. 

Recommendations 

We recommend that the Comptroller of the Currency do the following: 

1. Ensure that the current OCC guidelines for OFAC compliance 

examinations incorporate the policies and procedures contained in the 

FFIEC BSA/AML Examination Manual. 

2. Ensure examiners sufficiently and consistently document work 

performed so that an independent reviewer can clearly see which 

procedures were performed and ascertain the basis for all significant 

conclusions, including changes to regulatory ratings and risk profiles. 

Management Response 

OCC concurred with the first recommendation and reported that, as of 

June 2005, the FFIEC “Bank Secrecy Act/Anti-Money Laundering 

Examination Manual” has replaced the OCC-specific examination 

procedures for OFAC compliance. OCC agreed with the second 

recommendation and believes it is consistent with its current policy 

regarding work papers. OCC concluded that the level of exceptions noted 

in our audit report points to a need for improvement in practice. OCC will 

reinforce its expectations in this regard with examination staff. 

OIG Comments 

We believe that the actions OCC states in its response, if implemented as 

described, address the intent of our recommendations. 
FOREIGN ASSETS CONTROL: Assessing OCC’s Examination of OFAC Compliance 

 Was Hampered by Limited Documentation (OIG-06-033) Page 11

* * * * * * 

We would like to extend our appreciation to OCC personnel for the 

cooperation and courtesies extended to our staff during the reviews. If 

you have any questions, please contact me at (617) 223-8640. 

/s/ 

Donald P. Benson 

Director 
Appendix 1 

 Objective, Scope, and Methodology 

FOREIGN ASSETS CONTROL: Assessing OCC’s Examination of OFAC Compliance 

 Was Hampered by Limited Documentation (OIG-06-033) Page 12

Our objective was to determine the effectiveness of OCC 

examination efforts to ensure financial institution compliance with 

OFAC requirements. This audit was performed in conjunction with 

an audit of OFAC’s administration and enforcement of economic 

sanctions against targeted foreign countries, individuals, and 

groups. Because OFAC is legally limited in its ability to monitor 

financial institutions’ compliance with foreign sanction 

requirements, OFAC depends on financial institution regulators, 

such as the OCC, to ensure that the institutions comply with OFAC 

requirements. 

We reviewed OCC work papers to determine whether the 

examiners followed the examination guidelines in the OCC Bank 

Secrecy Act/Anti-Money Laundering Comptroller’s Handbook. The 

review focused on how OCC examiners identified each institution’s 

OFAC policies and procedures and addressed the risks associated 

with ensuring OFAC compliance. 

We judgmentally selected a sample of 18 banks, using asset size 

and geographic location as our main criteria. The sample 

examinations were conducted in fiscal years 2002 through 2005. 

Our sample included 3 banks that OFAC had reviewed for sanction 

violations. OFAC imposed civil monetary penalties against 2 of 

these banks and issued a warning letter to the third bank.

We requested copies of the most recent examination work papers 

and copies of all documentation that may have affected the scope 

of the OFAC reviews. The examination records were compiled by 

the OCC onto a computer CD ROM and were reviewed at our 

office. Because the work paper documentation appeared limited for 

some of the sampled examinations, we reconfirmed with the OCC 

audit liaison that the documentation provided represented all of the 

examination documentation that was available. 

We also compared the OFAC compliance guidance in OCC’s 

September 2000 Bank Secrecy Act/Anti-Money Laundering 

Comptroller’s Handbook with FFIEC’s June 2005 Bank Secrecy 

Act/Anti-Money Laundering Examination Manual. 
Appendix 1 

 Objective, Scope, and Methodology 

FOREIGN ASSETS CONTROL: Assessing OCC’s Examination of OFAC Compliance 

 Was Hampered by Limited Documentation (OIG-06-033) Page 13

We conducted our audit from March 2005 to April 2006 in 

accordance with generally accepted government auditing 

standards.
Appendix 2 

 Major Contributors to This Report 

FOREIGN ASSETS CONTROL: Assessing OCC’s Examination of OFAC Compliance 

 Was Hampered by Limited Documentation (OIG-06-033) Page 14

Stephen Syriala, Audit Manager 

Thomas Mason, Auditor-In-Charge 

Esther Tepper, Communications Analyst 

Horace Bryan, Referencer 
Appendix 3 

Bank Secrecy Act/Anti-Money Laundering Examination Manual Excerpt 

Core Examination Procedures 

FOREIGN ASSETS CONTROL: Assessing OCC’s Examination of OFAC Compliance 

 Was Hampered by Limited Documentation (OIG-06-033) Page 15

Objective

Assess the bank’s risk-based Office of Foreign Assets Control 

(OFAC) program to evaluate whether it is appropriate for the 

bank’s OFAC risk, taking into consideration its products, services, 

customers, transactions, and geographic locations. 

Procedures

1. Determine whether the board of directors and senior 

management of the bank have developed polices, procedures, 

and processes based on their risk assessment to ensure 

compliance with OFAC laws and regulations. 

2. Regarding the risk assessment, review the bank’s OFAC 

program. Consider the following: 

• The extent of, and method for, conducting OFAC searches of 

each relevant department/business line (e.g., automated clearing 

house (ACH), monetary instruction sales, check cashing, trusts, 

loans, deposits, and investments) as the process may vary from 

one department or business line to another. 

• The extent of, and method for, conducting OFAC searches of 

account parties other than accountholders, which may include 

beneficiaries, guarantors, principals, beneficial owners, nominee 

shareholders, directors, signatories, and power of attorney. 

• How responsibility for OFAC is assigned. 

• Timeless of obtaining and updating OFAC lists or filtering 

criteria. 

• The appropriateness of the filtering criteria used by the bank to 

reasonably identify OFAC matches (e.g., the extent to which 

the filtering/search criteria includes misspelling and name 

derivations). 

• The process used to investigate potential matches. 

• The process used to block and reject transactions. 

• The process used to inform management of blocked or rejected 

transactions. 

• The adequacy and timeliness of reports to OFAC. 

• The process to manage blocked accounts (such accounts are 

reported to OFAC and pay a commercially reasonable rate of 

interest). 
Appendix 3 

Bank Secrecy Act/Anti-Money Laundering Examination Manual Excerpt 

Core Examination Procedures 

FOREIGN ASSETS CONTROL: Assessing OCC’s Examination of OFAC Compliance 

 Was Hampered by Limited Documentation (OIG-06-033) Page 16

• The record retention requirements (i.e., five year requirement to 

retain relevant OFAC records; for blocked property, record 

retention for as long as blocked; once unblocked, records must 

be maintained for five years). 

3. Determine the adequacy of independent testing (audit) and 

follow-up procedures. 

4. Review the adequacy of the bank’s OFAC training program 

based on the bank’s OFAC risk assessments. 

5. Determine whether the bank has adequately addressed 

weaknesses or deficiencies identified by OFAC, auditors or 

regulators. 

Transaction Testing 

6. On the basis of a bank’s risk assessment, prior examination 

reports, and a review of the bank’s audit findings, select the 

following samples to test the bank’s OFAC program for 

adequacy, as follows: 

• Sample new accounts (e.g., deposits, loan, trust, safe deposit, 

investments, credit cards, and foreign office accounts,) and 

evaluate the filtering process used to search the OFAC database 

(e.g., the timing of the search), and documentation maintained 

evidencing the searches. 

• Sample appropriate transactions that may not be related to an 

account (e.g., funds transfers, monetary instrument sales and 

check cashing transactions), and evaluate the filtering criteria 

used to search the OFAC database, the timing of the search, 

and documentation maintained evidencing the searches. 

• If the bank uses an automated system to conduct searches, 

assess the timing of when updates are made to the system, and 

when the most recent OFAC changes were made to the system. 

Also, evaluate whether all of the bank’s databases are run 

against the automated system, and the frequency upon which 

searches are made. If there is any doubt regarding the 

effectiveness of the OFAC filter, then run tests of the system 
Appendix 3 

Bank Secrecy Act/Anti-Money Laundering Examination Manual Excerpt 

Core Examination Procedures 

FOREIGN ASSETS CONTROL: Assessing OCC’s Examination of OFAC Compliance 

 Was Hampered by Limited Documentation (OIG-06-033) Page 17

by entering test account names that are the same as or similar 

to those recently added to the OFAC list to determine whether 

the system identifies a potential hit. 

• If the bank does not use an automated system, evaluate the 

process used to check the existing customer base against the 

OFAC list and the frequency of such checks. 

• Review a sample of potential OFAC matches and evaluate the 

bank’s resolution and blocking/rejecting processes. 

• Review a sample of reports to OFAC and evaluate their 

completeness and timeliness. 

• If the bank is required to maintain blocked accounts, select a 

sample and evaluate that the bank maintains adequate records 

of amounts blocked and ownership of blocked funds, that the 

bank is paying a commercially reasonable rate of interest on all 

blocked accounts, and that it is accurately reporting required 

information annually (by September 30th) to OFAC. Test the 

controls in place to verify that the account is blocked. 

• Pull a sample of false hits (potential matches) to check their 

handling; the resolution of a false hit should take place outside 

of the business line. 

7. Identify any potential matches that were not reported to OFAC, 

discuss with bank management, advise bank management to 

immediately notify OFAC of unreported transactions, and 

immediately notify supervisory personnel at your regulatory 

agency. 

8. Determine the origin of deficiencies (e.g., training, audit, risk 

assessment, internal controls, management oversight,) and 

conclude on the adequacy of the bank’s OFAC program. 

9. Discuss OFAC related examination findings with bank 

management. 

10. Include OFAC conclusions within the report of examination, as 

appropriate. 
Appendix 4 

Management Response 

FOREIGN ASSETS CONTROL: Assessing OCC’s Examination of OFAC Compliance 

 Was Hampered by Limited Documentation (OIG-06-033) Page 18
Appendix 4 

Management Response 

FOREIGN ASSETS CONTROL: Assessing OCC’s Examination of OFAC Compliance 

 Was Hampered by Limited Documentation (OIG-06-033) Page 19
Appendix 5 

Report Distribution 

FOREIGN ASSETS CONTROL: Assessing OCC’s Examination of OFAC Compliance 

 Was Hampered by Limited Documentation (OIG-06-033) Page 20

Department of the Treasury

Under Secretary, Office of Terrorism and Financial Intelligence 

Assistant Secretary, Terrorist Financing and Financial Crimes 

Office of Strategic Planning and Performance Management 

Office of Accounting and Internal Control 

Office of Comptroller of the Currency

Comptroller 

Office of Foreign Assets Control

Acting Director 

Office of Management and Budget

OIG Budget Examiner