Page 14

coupetation

cooperation before
notice

Effectiveness of Weak Practices vary | Deficient oversight, | Lax compliance efforts, é
BSA Internat oversight, or | from Board Jax compliane deficient controls,
Conirol policies are | approved policies } efforts, weak money laundering
Environment (11) stale or and procedures. | controls and/or ifficit

procedures transactions detected

are weak
SUBTOTAL |
Corrective Action to | No Limited ‘Complete Partial corrective | Complete corrective 4
Remediate corrective | corrective | corrective action | action voluntarily | action voluntarily before
deficiencies (13) action action afler | after notif before notification | notification
and or Restitution notification
) _—
Cooperation and ‘None Limited Full disclosure and [Institution self 4
disclosure (4) disclosure or cooperation after | identities voluntarily,

limited notice fill disclosure and

SUBTOTAL 2

TOTAL
{subtract 2 from 1)

INon
IResponsiv

14

INon
IResponsiv



Ability to Pay

Guidelines
For Examiners

INon
IResponsiv

Page 5

Any threat of loss, actual loss, or other harm to the institution, including harm to
public confidence in the institution, and the degree of such harm;

Evidence that a participant or his or her associates received financial gain or other
benefit as a result of the violation or practice;

Evidence of any restitution paid by a participant of losses resulting from the
violation or practice;

History of prior violation or practice, particularly where they are similar to the
actions under consideration;

, Previous criticism of the institution or individual for similar actions;
. Presence or absence of a compliance pragram and its effectiveness;

. Tendency to engage in violations of Jaw or unsafe or unsound banking practices;

and

. The existence of agreements, commitments, orders, or conditions imposed in

writing intended to prevent the violation or practice.

The BSA/AML CMP Matrix should be used to calculate the CMP amount before any
adjustments are made for mitigating factors, such as the amount of financial resources of
the institution, ‘The CMP amount should not be adjusted for corrective action since the
matrix already provides credit 10 the institution for “corrective action” under Subtotal 2
of the BSA/AMI. CMP Matrix.

When determining the ability to pay a CMP, examiners should analyze the institution’s
financial condition, including Tier | capital, total capital, and earnings. The inslitution’s
assigned examination rating does not preclude examiners from completing the matrix, If
there is cause to assess a CMP, the matrix should be completed and the institution’s
ability to pay should be evaluated after the penalty amount is determined,

The guidclines listed below should be observed during examinations of
institutions when a CMP may be recommended.

RMS and Legal staff at the RO should be promptly notified of any examination,
visitation, investigation, or other supervisory activity that uncovers misconduct
that may warrant a CMP action. When the pursuit ofa CMP appears warranted,
examiners should consult with the RO for guidance on what evidence is required
to support a CMP recommendation.

Examiners should not discuss a potential CMP related to noncompliance with an

INon

IResponsiv

existing 8(b) order with bank management. They may indicate generally that

5 _



Page 10

Violations or deficiencies need not be continuous to clevate concern; and
violations or deficiencies that were identified in carlier examinations should be
considered in applying this factor, even if they have been corrected or there has
been an intervening examination in which no similar violation or deficiency was
reported. An example foliows:

a. Level “1” score: Same or similar criticism. An example would be where
there was criticism of BSA/AML training for not completing training for
new employees at a prior examination, and a BSA/AML. training
deficiency was noted for lack of training for Board of Directors cited at
current examination.

b. Level “2” score: Same root cause, different misconduct. An example
would be deficiencies in the internal control environment resulting in
suspicious activity reporting violations at the prior examination. During
the current examination, the weak internal control environment led to the
citation of information sharing violations,

c. Level “3” score: Same root cause, similar misconduct. An example
would be an institution failing to have adequate BSA internal controls ata
prior examination and now having suspicious activity report (SAR) and
CTR violations resulting from inadequate internal controls at the current
examination.

d. Level “4” score: Same root cause, same misconduct. An example would
be where an institution was cited for a BSA internal control violation at
the fast examination and again at the current examination with the samc
circumstances.

8. Duration of Misconduct Prior to Notification or Discovery: “Notification” in
this factor means the same as that under “Continuation after Notification.” In
determining the duration of the misconduct, the entire time period during which
the misconduct occurred should be considered, not just the time period that was
reviewed. The score on the matrix for this factor is based primarily on the length
of time the misconduct occurred, with misconduct excecding 18 months receiving
the most severe score. Use the following timeframes to determine the assigned
level:

a. Level “1” score: Less than or equal to 6 months
b. Level “2” score: Over 6 months and up to [2 months
c. Level “3” score: Over 12 months and up to 18 months

d. Level “4” score: Over 18 months

INon . 5 . : ; eget .. Non
Responsiv 9. Frequency of Misconduct prior to Notification or Discovery: “Notification” in Responsiv

this factor means the same as that under “Continuation after Notification.” In

10 :



INon
IResponsiv

Page 7

The BSA/AML CMP Matrix is a tool intended to result in a consistent and equitable
approach to develop a CMP amount, The BSA/AML CMP Matrix is offered only as
guidance; it does not reduce the CMP process to a mathematical equation and should not
be a substitute for experience and sound supervisory judgment. The BSA/AML CMP.
Matrix in no way limits the discretion of the FDIC to evaluate the precise facts and
circumstances of each case, or other matters as justice requires, into the CMP
determination.

Guidelines for Scoring the BSA/AML Matrix Factors Under Subtotal 1

‘The following instructions for scoring the matrix factors are provided for guidance only
and are not intended to limit FDIC staff discretion, Ultimately, staff must complete the
BSA/AML CMP Matrix based on the facts and circumstances of the particular case.

Where the information below refers to “Institution,” it applies in the same manner to
IAPs.

1. Intent: This factor requires a review of the extent to which the violation or
practice was intentional, including whether the violation was committed with
recklessness or willful disregard of the law.

“No intent” (level “0” score) would be appropriate where an institution
violated the law despite reasonable efforts and systems to ensure
compliance.

“Carcless” (level “1” score) would be appropriate where an institution
made reasonable efforts to comply with the law but made an error or
errors due to inadequate diligence.

“Should have known” (level “2” score) would be appropriate where an
institution should have been aware of the risk associated with the
conduct at issue but continued to act without addressing the risk. This
would involve situations where an institution learned of the potential
risk yet did nothing to mitigate such risk. Additionally, if an
institution contracted out a service to a third party and the third party,
including an affiliate, violated the law, the institution should have
known about such violation because it should have been monitoring
such activity.

“Reckless Conduct” or “Willful Disregard” (level “3” score) would be
appropriate where an institution was aware that its internal controls
environment, policies, procedures, and/or staffing likely would fail to
detect and prevent a violation and yet did nothing to redress the risk.
For example, ifan institution were criticized during an examination for
employing an insufficicnt number of staff given its high-risk
transaction volume, and subsequently were to increase the transaction
yolume but not to increase staff, the institution’s intent with respect to
ensuing violations may be deemed reckless.

7 bo]

INon

IResponsiv



Guidelines for Using

Page 6

noncompliance with an order could result in further action by the FDIC,
including, but not limited to, the assessment of a CMP.

e Evidence supporting a recommendation for a CMP should be segregated from
regular examination documents to make it easier to support the CMP in
administrative or judicial litigation.

« Apparent violations of laws and regulations or unsafe or unsound prac
should be fully discussed with the institution’s managers, but disci
CMP process should be limited. If a CMP recommendation appears likely,
examiners may discuss criteria the FDIC considers and explain the
administrative procedures followed to assess a CMP; RO Legal staff are
available to provide advice to assist with such discussions. Examiners may

indicate generally that violations of laws and regulations or unsafe or unsound
could result in further action by the FDIC including, but not limited to,

practice
the assessment of a CMP.

¢ A determination of financial gain or other benefit to an individual or entity or
financial loss to the institation resulting from the violations or unsafe or
unsound practices should be considered. Such gain or loss is not necessary to
support the assessment of a BSA/AML CMP.

© When violations or unsafe or unsound practices are of the type detailed in Section
8(i) of the FDI Act, and a CMP is contemplated as an appropriate administrative

action, examincrs should complete the BSA/AML CMP Matrix,

e Examiners, with consultation from RMS and Legal staff in the RO, should
evaluate and consider all instances in the development of the CMP

recommendation where law enforcement identifies specified unlawful activity.

« CMP actions against institutions may fall under the Equal Access to Justice Act,

which provides that partics who prevail in contested administrative or judicial

proceedings against a Federal agency may be able to recover litigation expenses
from the agency if the agency’s position in the proceeding was not substantially
justified. For this additional reason, CMP recommendation memos and resulting

enforcement actions should be properly supported by the evidence,

the BSA/AML CMP Matrix

INon
IResponsiv

The BSA/AML CMP Matrix incorporates the 13 factors identified by the Intcragency
Policy as relevant in determining the appropriateness of initiating a CMP assessment.
These factors, along with those statutorily provided, are also used in determining the
assessed amount of a CMP. There may be occasions where the examiner does not
recommend a CMP based on the overall score. However, whenever a CMP is being
considered against an institution, the BSA/AMI CMP Matrix must be completed.

. 5 .

INon
IResponsiv



Page 9

written agreement between an institution and the FDIC. Substantive violations
(e.g., Program, Pillar or systemic) warrant a more severe score including,
potentially, the highest score. A significant number of substantive violations may
also justify the highest score.

4, Failure to Report and/or Monitor for Suspicious Activity/Systemic Failure to
Complete Currency Transaction Reports (CTR)s: ‘Vhe institution exhibited
systemic failures to file, or correctly file, reports required by the BSA, or, where
required by law, failed to implement systems to ensure the reporting or accuracy
of this data, The “Look Back” requirement in most cases is a provision of a
formal enforcement action and would require the highest score.

5. History of Previous Supervisory Actions: This matrix factor refers to a forma} or
informal enforcement action that addressed the same or a related issue previously.
This factor is based on the extent to which prior informal or forma! enforcement
actions or conditions imposed in writing by the FDIC were required to address or
prevent a violation, underlying practice, or unsafe or unsound practice, The type
of supervisory action taken will be considered when determining the score for this
factor. ‘The score for this factor will generally be assigned as follows:

Level “1” score: A different violation or deficiency (i.e., distinct root
cause) resulted in an informal enforcement action.

Level “2” score: A similar violation or deficiency (Ze.
resulted in an informal enforcement action.

same root cause)

Level “3” score: Again, the same root cause but violations and deficiencies
resulted in a formal enforcement action.

Level “4” score: The institution has an informal or formal enforcement action
outstanding and has a history of noncompliance with laws and regulations.

6. Continuation After Notification: This factor is based on the bank’s response
after notification. Notification occurs when an institution becomes aware that its
action/non-action constitutes misconduct, a deficiency or a violation. Notification
includes notice of misconduct by the FDIC, other regulatory agencies, external
auditors, internal auditors, or other parties, including law enforcement. In
addition, notification includes discovery by bank staff with notice to a member of
management of the misconduct. ‘The term “continuation” refers to the activity
itself, not any lingering result. For example, an institution may not be collecting
appropriate information on its customers as required under the Customer
Identification Program Rule (CIP). If, after notification, the institution continues
not to collect proper CIP information, this may be considered as continuing the
violation.

7. History of Previous Violations and Previous Deficiencies: ‘Vhis factor is based

on history of prior violations or practices (particularly where they are similar to Non

INon . : - : wee . .
the actions under consideration) and previous criticism (including any Responsiv

IResponsiv

recommendations made in the Report of Examination or other supervisory
correspondence) of the institution or LAP for similar actions.

Ls] 9 L =|



Page 1

Instructions and Matrix for Bank Secrecy Act/Anti-Money
Laundering Civil Money Penalties Against Institutions

Introduction The following section describes FDIC policy and procedures governing the imposition of
a Civil Money Penalty (CMP) in a Bank Secrecy Act/Anti-Moncy Laundering
(BSA/AML) case, ‘the section also includes the grounds for assessing a CMP and the
factors considered in determining an amount. Staff should use the instructions and the
BSA/AML CMP Matrix when considering the assessment of a CMP against an institution
or institution-affiliated party (IAP) that is a corporate entity. Alternatively, when
considering a CMP against individuals, staff should use the Instructions and the Matrix
for CMPs Against Individuals.

Statutory criteria set forth in Section 8(i) of the Federal Deposit Insurance Act (FDI Act)
must be considered for all CMP determinations. The FDIC adopted the /998 FFIEC
Interagency Policy Regarding the Assessment of Civil Money Penalties by the Federal
Financial Institutions Regulatory Agencies (Interagency Policy), which states in part, “In
determining the amount and the appropriateness of initiating a civil money penalty
assessment proceeding under statutes requiring consideration af five statutory factors, the
agencies have identified 13 factors as relevant.” Note that a CMP against institutions for
BSA/AML Compliance Program failures may involve additional matters that should be
considered along with the identified £3 factors.

Statutory Section 8(i)(2) of the FDI Act authorizes the FDIC to assess a CMP.
Authority _
CMP Tiers Section 8(i)(2) of the FDI Act authorizes the assessment of a CMP and divides them

into three tiers. Penalties are assessed against an insured depository institution or IAP
based on the severity of the violation, level of culpability, and can be levied for each
day the actionable conduct continucs. ‘The statute sets forth penalty amounts for all
three tiers, which are periodically adjusted for inflation. The current maximum penalty
amount for cach tier can be found in Section 308.132(c)(3)(i} of the FDIC Rules and
Regulations.

Tier 1 — An insured depository institution or IAP may be assessed a CMP of up to $7,500
per day for a violation of any law or regulation, any final or temporary order, any
condition imposed in writing in connection with the granting of any application or other
request by an institution, or any written agreement between an institution and the FDIC.

Non Tier 2 — An insured depository institution or IAP may be assessed a CMP of up to Non
Responsiv $37,500 per day for a violation listed under Tier 1, recklessly engaging in an unsafe or —_ Responsiv

unsound practice, or any breach of fiduciary duty, if the violation, practice, or breach:

- 1 _ :



Page 12

strength or weakness of the institution’s BSA/AML Compliance Program. In
evaluating the BSA/AML Compliance Program, examiners should consider the
extent to which the program components are effective. In general, the more
components that have weaknesses, the greater the score. Additionally, if illicit
financial transactions are detected, the highest score would be appropriate.
Similarly, BSA/AML Compliance Programs that are so lacking as to permit
violations to occur and remain undetected should also be accorded the most
severe score, In contrast, a BSA/AML Compliance Program that identified the
violation/deficicncy, allowing the institution to initiate timely corrective
measures, may teccive a lower score. This factor should not be applied to the
citing of the BSA/AMI. Program violation under 12 CFR Section 326.8.

Guidelines for Scoring the BSA Matrix Factors Under Subtotal 2

This portion of the matrix provides the institution positive consideration for corrective
action, cooperation, and disclosure.

stor, examiners should

1. Corrective Action and or Restitution’: In assessing this
consider whether an institution has taken other remedial action to correct or
mitigate al] past harms arising out of the institution’s past practices, Steps taken to
prevent future violations do not constitute restitution or remediation of past
violations. An institution that seff-identifies a violation after the examination
commences, and provides full corrective action prior to notification of the violation
by the FDIC or other regulatory agency, should be awarded the highest score for
this factor. Partial corrective action(s} would include instances where the institution
did not make full corrective action or did not properly identify all necessary
corrective action(s).

2. Cooperation and Disclosure: In assessing this factor, examiners should consider
the extent to which an institution has been cooperative after examiners have
identified a violation, raised it with management, and the FDIC has begun to take
steps to stop or remedy the violations through supervisory actions. The FDIC
expects its institutions to fully cooperate with our examination efforts. An
institution that sclf-identifies a potential violation and alerts the FDIC of its
concerns regarding the issue, or proactively cooperates with the FDIC to resolve the
issue, will be awarded the highest score of “4” for this factor. An example of
proactive assistance would include where the institution begins to investigate the
matter once it is discovered. Ifan institution does not meet the criteria for a score
of “4” but provides full and prompt cooperation to the FDIC, the institution should
receive a score of “3.” An institution that does not provide full and prompt
cooperation may receive a score of “1” or “2.”

INon INon
IResponsiy_——_—--——_ IResponsiv

is unlikely that circumstances requiring restitution in a BSA/AML. institutional CMP case would arise.

R nd |


INon
IResponsiv

10.

Page 11

determining the frequency of the misconduct, examiners need to first determine if
the misconduct was isolated, infrequent, frequent, or a pattern or
practice/systemic.

a. Level “1” score: The institution’s misconduct was isolated. In assessing
this factor, a single transaction that violates multiple regulations is
considered one instance of misconduct.

b. Level “2” score: The institution’s misconduct was infrequent.
“Infrequent” means the occurrence of the misconduct took place over long
intervals, and did not occur regularly.

c. Level “3” score: The institution’s misconduct was frequent. “Frequent”
means misconduct that occurs often, but not as regular as a pattern or
practice.

d, Level “4” score: ‘The institution’s misconduct, deficiency or violation
rises to the level of a pattern or practice/systemic. In assessing this factor,
a pattern or practice may be found when each instance or transaction that
is considered misconduct is based on systemic failures (¢.g., 50 failures to
file accurate and complete CTRs may be considered a systemic failure if
the institution generally only files a small number of CTRs). Misconduct
that is excluded due to the expiration of the statute of limitations should
not be included when scoring this factor.

Gain or Other Benefit to the Institution and/or Loss or Risk of Loss to the
institution: This factor considers whether the institution received financial gain
or other benefit from the misconduct at issue. In assessing this factor, examiners
should consider any direct or indirect monetary gain or other benefit to the
institution, A practice may not have resulted in monetary gain but may have
resulted in some other benefit to the institution. Examiners may also find cz
where there is no financial gain or other benefit, but there is loss or risk of loss,
For example, an institution that permits structuring may not realize a gain or
benefit, but repeated, extended, or flagrant BSA/AMI. failures subject the
institution to risk of loss. BSA/AML failures that facilitate a fraud resulting in
actual loss should reccive the highest score.

. Impact Other Than Loss: \n assessing this factor, it is appropriate to consider

any possible negative impact or harm to the bank and the banking industry, other
than loss. Activity that facilitates money laundering or other illicit financial
transactions could negatively affect the public’s confidence in the bank or the
banking industry. Conducting a few transactions, or failing to report a few
transactions, may present risks that are confined to one bank. In contrast,
conducting high-risk, high-dollar, high-frequency transactions with other banks
through funds transfers and correspondent banking may adversely impact public
confidence in the bank or the banking industry.

. Effectiveness of BSA/AML Internat Control Environment: Vxaminers should

evaluate if and how an institution’s BSA/AML Compliance Program or lack
thereof, contributed to the violation and/or deficiency in question for which a
CMP is being considered. In applying this factor, the rclative consideratier’is the

“TE

INon
IResponsiv



INon
IResponsiv

Page &

“Deliberate” (level “4” score) would be appropriate where an
institution engaged in conduct that it knew would violate a law. This
score requires the institution to have actively participated in —i.¢., to
have knowingly aided and abetted conduct that is deemed.a violation.
If an institution facilitated a key customer’s structuring, for example,
such misconduct would qualify as deliberate.

2. Concealment: ‘The focus of this factor is on the actions of the institution or
officers, employees, or others working on the institution’s behalf when FDIC
examiners or other FDIC personnel (or others such as the institution’s auditors,
other regulatory agencies, or law enforcement) are attempting to determine
whether an institution violated any law or regulation or engaged in unsafe and

unsound practices. This factor would also apply if a corporate entity IAP sought
to conceal violations or practices from bank management. Also, the focus of this
factor is on deliberate (as opposed to inadvertent) conduct by the institution or its

officers and employees in connection with withholding documents and
information. This includes, but is not limited to, not providing documents or

other information as requested by the examiners or FDIC personnel. Scoring of

this factor should not consider actions by the institution or individuals after the

FDIC identified the violation. Thus, any actions taken by the institution would be

considered under the cooperation mitigating factor.

a. Level “0” scorc: Applies to those situations in which the institution
promptly supplics all documents and information requested regarding a
possible violation of law or regulation.

b. Level “1” score: Applies when the institution purposely complicates an
issue to make it difficult to uncover, but supplies accurate and complete

documents and information from which the violation can be ascertained by

examiners,

c. Level “2” score: Applies when the institution cannot provide documents

or information because it deliberately fatled to keep adequate records as
required by law.

d. Level “3” score: Applies when the institution both deliberately obstructs

FDIC examiners or others in an attempt to make an issuc difficult to
uncover, and recklessly and/or intentionally failed to keep adequate
records as required by law.

c. Level “4” score: Applies in those situations where the institution

deliberately falsified documents or destroyed documents with the intent to
impede an investigation or review and/or provided inaccurate, misleading,

or false information to FDIC examiners or others.

3. BSA/AML Compliance Program Violation or Systemic Deficiencies: This
factor includes any BSA/AML law or regulation, any final or temporary order,
any BSA/AML condition imposed in writing in connection with the granting of
any application or other request by an institution, or ary BSA/AML related

8 Lo = |

INon

IResponsiv



INon
IResponsiv

Page 4

If the FDIC determines that the violation or unsafe or unsound practice was
particularly egregious, then a larger recommended CMP is warranted.

3. The institution’s BSA/AML history of previous violations; and

Qualitative factors may include: the institution’s regulatory enforcement history;
the identification of an individual(s) who was willful and culpable in the
violation(s) and his or her position(s) at the institution; the breakdown in the
internal control environment as well as the corporate culture, including Board
oversight; and the implementation of policies and procedures.

4. Such other matters as justice may require.

Consideration may be given to other possible fines, penalties, or monetary
sanctions (¢.g., Department of Justice, Financial Crimes Enforcement Network,
Office of Foreign Assets Control, state authorities, or reimbursement of costs of
prosecutors’ investigations).

Jn addition, the Regional Office (RO) and Washington Office (WO) should
consider recent BSA/AML-related CMP cases for comparison purposes to ensure
that the CMP is appropriate for the nature and gravity of the issues,

Violations of law or regulation, any final or temporary order, any condition imposed in
writing in connection with the granting of any application or other request by an
institution, any written agreement between an institution and the FDIC, or any regulatory
reporting requirement may result ina CMP. Additionally, a CMP may be imposed for
unsafe or unsound banking practices and when there is evidence of possible money
laundering or other movement of illicit funds.

The Interagency Policy Statement indicates that CMP recommendations should be
initiated only when the fincable violation or practice is believed to meet the test of
gravity as required by the Financial Institutions Regulatory and Interest Rate Control Act
of 1978, including consideration of the 13 relevant factors found in the Interagency
Policy:

1. Evidence that the violation or practice was intentional or committed with
disregard of the law or with a disregard of the consequences to the institution;

2. The duration and frequency of the violations or practices;

3. The continuation of the violations or practices after the respondent was notified
or, alternatively, its immediate cessation and correction;

4. The failure to cooperate with the agency in effecting carly resolution of the
problem;

5. Evidence of concealment of the violation or practice or, alternatively, voluntary

INon

disclosure of the violation or practice; .
IResponsiv

4 a


Page 15

MATRIX FOR BSA/AML CMPs AGAINST INSTITUTIONS

Base Penalty Range _ Penalty Formula —
Points from Matrix Total Assets $1 Billion or less Total Assets Over $1 Billion!
Q- 100 None’ None
| 101-130 $10,000 - $25,000 Total Assets / | billion x penalty
131-150 $25,000 - $45,000 Total Assets / | billion x penalty
151-170 $45,000 - $65,000 Total Assets / | billion x penalty
171-190 _ $65,000 - $85,000 Total Assets / 1 billion x penalty
191-210 z $85,000 - $200,000 Total Assets / 1 billion x penalty |
211-220 7 $200,000 - $400,000 Total Assets / 1 billion x penalty |
221-240 $400,000 - $600,000 Total Assets / 1 billion x penalty
241-260 _ $600,000— $800,000 Total Assets / 1 billion x penalty
261-290 $800,000 - $1MM Total Assets / 1 billion x penalty
291-310 $1MM - $2MM Total Assets / 1 billion x penalty
311-330 $2MM - $3MM Total Assets / 1 billion x penalty
331-350 $3MM - $4MM Total Assets / 1 billion x penalty
351-370 _ $4MM - $5MM Total Assets / 1 billion x penalty |
371-390 $5MM - $6MM Total Assets / 1 billion x penalty
[ 391-400 $6MM - $7MM Total Assets / 1 billion x penalty
400 +4407 $7MM + _ Total Assets / 1 billion x penalty

Note: The suggested CMP ranges are provided for guidance only and are not intended to limit staff discretion to
assess a penalty below or above the recommended amounts, taking all facts into account.

“Phe penalty amount for institutions over $1 billion is determined using two steps. First, a penalty amount is determined using the
range under “Total Assets over $1 Billion.” Second, that penalty amount is multiplied by total assets and divided by $1 billion. For
cxample, an institution with $2.2 billion in total assets scores 248 points on the matrix. The recommended penalty range under $1
billion column is $600,000 to’$800,000. The penalty range for a $2.2 billion institution would be $1.32MM to $1.76MM. (The actual

calcul

ion steps would be: first, Tota! Assets/$1 billion or in this example, $2.2 billion/I bitlion for a factor of 2,2. Then, multiply

this factor times the low end and high end of the range for banks up to $1 billion, ‘The result is: 2.2 x $600,000, which results in a low
end range of $1.32MM and then 2.2 x $800,000, which results in a high end range of $1.76MM.)

? Ifa CMP are not pursued, examiners may still consider other appropriate supervisory action to address the deticiency.

INon
IResponsiv

per day, should be calculated and considered.

a

Is

3 Jn instances where the matrix score is over 400 and the bank’s assets are more than $1 billion, the statutory maximums per violation,

INon
IResponsiv

Ce


Page 3

© Previous BSA formal or informal enforcement actions (e.g., Board Resolution,
Memorandum of Understanding, Consent Order or CMP) have been ineffective in
eliminating or deterring a violation, pattern or practice;

© The institution has a violation of the BSA/AML Compliance Program and a history of
noncompliance with non-BSA/AML laws and regulations;

¢ Failure to maintain a satisfactory BSA/AML Compliance Program, which includes
Pillar violations; and

¢ A violation or practice that directly or indirectly involves an IAP or related interest
who received material or substantial benefit from the activity.

CMPs should be used with discretion as they are designed to be punitive. The primary
purpose of the penalty is to sanction violators according to the degree of culpability and
severity of the violation. The penalty should also be used as a deterrent against future
violations. In order to ensure the penalty will be considered punitive and deter future
violations, the BSA/AML CMP Matrix takes into consideration the institution’s total
assets, Effecting remedial action is not the primary purpose of a CMP. Remedial action,
jn the form of other corrective measures, may be separately pursued under Section
8(b)(6) of the FDI Act. A CMP should be considered in conjunction with such remedial
actions.

Considerations Section 8())(2)(G) of the FDI Act requires that, in determining whether to
In Assessing CMPs assess a CMP or the amount of a CMP, the FDIC must consider:

2

INon
IResponsiv

1. The size of the financia] resources and good faith of the institution;
In determining a CMP amount, several quantitative and qualitative factors”
should be considered, including the institution’s asset size, capital level, and
overall financial condition,
Consideration may be given to reducing the amount of the CMP, if the institution
cooperates, makes full and timely corrective action, and/or assists the regulatory

agency in the investigation.

2. The gravity of the violation;

Recommendations to pursue a BSA/AML. CMP must be sent to the Washington Office as a Pre-Review Memorandum, witha

lompleted CMP Matrix and documentation that includes the quantitative and qualitative factors, including comparables, used to INon
ictermine the CMP amount. Responsiv

ee 3 : WSs


Page 2

Is part of a pattern of misconduct; or
Causes or is likely to cause more than a minimal loss to the institution; or

Results in financial gain or other benefit to such party.

Tier 3 — An insured depository institution or [AP may be assessed a CMP for
knowingly committing any violation, practice, or breach of a fiduciary duty listed under
Tier 1 or 2 and knowingly or recklessly causing substantial loss to an institution or
substantial financial gain or other benefit to such party. For a depository institution, the
maximum CMP is the lesser of $1,375,000 or L percent of the institution’s total assets
per day during which the violation, practice, or breach continues. In the case of an

IAP, the maximum fine is $1,425,000 per day per violation.

Historically, most CMPs with a BSA/AMI, basis have bcen assessed a Tier 1 CMP and
generally involved violations of laws, regulations, and FDIC formal enforcement actions.
A CMP may be cumulative (i.¢., the maximum amount may be aggrcgated for every day
the violation, practice, or breach continues). If the maximum possible Tier 1 CMP does
not adequately reflect the scrious nature of the misconduct (¢.g., a long history of
noncompliance with laws and regulations, or evidence of the passible flow of criminal
funds is detected), then a Tier 2 CMP would be appropriate if the clements were satisfied.
A Tiet 2 CMP may be justificd based upon the finding of a pattern or practice of
misconduct. For instance, misconduct that warrants a Tier 2 CMP would meet the
standard as a reckless unsafe or unsound practice, or more routinely as a breach of
fiduciary duty', A Tier 3 CMP may be justified when the institution or IAP knowingly or
recklessly caused substantial financial loss or gain to the institution. Consulting with the

FDIC’s Legal Division

strongly advised. Note that in institutional or JAP cases, the

collective actions of individuals can be imputed to the entity.

Policy A recommendation for assessment of a CMP against an institution or IAP should be
considered in BSA/AML cases when one or more of the following criteria are present:

INon

IResponsiv

A violation or practicc that potentially exposes the insured depository institution to
money laundering or other illicit financial activity or caused substantial harm to the
public confidence in the institution;

A violation or practice that is willful, flagrant, or demonstrates bad faith on the part of
an insured depository institution or [AP (e.g., repeated or multiple violations);

| iduciary duty is the ubkigalion of an institution’s directors, officers, and employces to act in the best interests of their financial

institution and depositors.

INon

L

Non

IResponsi

IResponsiv



Page 13

money laundering
and/or other ilficit
transactions

lsundering and other
illicit financial
transactions

Factors to be 1 2 3 4 Assigned | Weight | Weight
Considered Level Factor | Facto
X Level
intent (F) No Intent Careless Should have Reckless or Willful | Deliberate 15
_. Known Disregard ___
Concealment (5) None Purposeful | Deliberate failure | Deliberate Deliberate fatsification is
complication | to keep adequate | obstruction and or destraying of
ofan issue/ | records deliberately or dacumneats or providing
obstruction recklessly failed to | false information to
keep adequate cxamniners or others
records |
BSA/AMI Program | None Technical Sy BSAZAMI, Failure to comply with 10
violation or violations | violations or Program, Pillar Section 8(b)
systemic recurring violations
deficiencies: violations that
(HE 102) are not Pillar
Violations
Failure to report None Institution | Repeat failure to. [ Numerous repeat | Substantial ropcat i)
Suspicious Activity fails to report | report and/or failures to report re and/or Failure to
and/or monitor for and/or implement and/or implement | implement appropriate
Suspicious Activity implement | systems designed | systems designed to. | monitoring systems to
Look Back required systems to ensure ensure accurate ensure data accuracy.
and/or a systemic designed to. | accurate reporting of Look Back or
faiture to complete ensure reporting of required data ‘Transaction review
CTRs (i) accurate required data required for SARs or
reporting of CTRs
required data | 7 _
History of alt None Different —_| Similar violation” | Violations and informal or formal 10
previous BSA/AML. violation or | ordeficiencies | deficiencies result | enforcement actions
supervisory actions deficiencics | results in in formal outstanding, History of
(13) results in informal enforcement actions | noncompliance with
informal enforcement issued lawy, regulation or order
enforcement | action issued
action issued _ _
Continuation after Violation(s) | Vioialion(s) Violation(s) Violation(s) stil 8
notification (3) ceased continued for continued for long | continuing
promptly short period of | period of time after
upon time afler notification, more
cation | notification, less | than 3 months
. than 3 months -
History of previous} None Same or Same root Same root cause, | Same root cause/same g
violations or simitar cause/different | similar misconduct | misconduct
previous misconduct
deficiencies (9) (10) |___ -
Duration of 006 Gver Sand upto | Over [Zandupto | Gver 18 months g
misconduct prior to months 12 months 18 months
notification or
discovery (2) _ _
Frequency of Isolated Morcthan one | FroquentRepeated | Pattern or practice 8
misconduct prior to instance of | instance of
notification or misconduct | misconduct’
discovery (2) infrequent oo
Gain or other None Tndiect gain or” | Direct gain or Substantial direct gain 6
benefit to institution benefit to benefit to or benefit to institution,
(2); and/or loss or institution, institution; and/or | and/or substantial actual
risk of loss ta the and/or some moderate actual loss | loss
institution actual loss or risk of substantial
-_ loss
Impact other than | None Institation Moderate impact on | Substantial impact an 6
loss (6) exposed to banking industry or | banking industry or
limited risk of — | public confidence in | public confidence in
money banking due toan | banking; Hvidence of
laundering isolated instance of | significant money

INon
IResponsiv

43

INon
IResponsiv