Source: https://nafcucomplianceblog.typepad.com/nafcu_weblog/ofac/
Timestamp: 2019-04-19 02:48:01+00:00

Document:
Last Friday, the Office of Foreign Assets Control (OFAC) released a notice reminding credit unions and other financial institutions that the annual report of blocked property is due by September 30th. As the annual filing is only one of the multiple OFAC requirements for blocked property, we thought it would be helpful to break down the other steps a credit union must take to meet its regulatory requirements.
In general, OFAC regulations require that credit unions block accounts and other property as well as reject unlicensed trade and financial transactions of certain countries, entities, and individuals. See, FFIEC BSA/AML Examination Manual, pp. 147. Aside from that, you may remember that NAFCU blogged earlier this year and noted that OFAC takes a risk-based approach to compliance so credit unions will have the flexibility of determining when and how to run transaction names through OFAC lists. So what happens once the credit union identifies property subject to a blocking program?
Once the credit union has determined that funds need to be blocked, the blocked property must be placed into an interest-bearing account from which only OFAC-authorized debits may be made. See, 31 C.F.R. § 515.205(a). OFAC defines an interest bearing account as "a blocked account earning interest at no less than the maximum rate payable on the shortest time deposit in the domestic bank where the account is held: Provided however, That such an account may include six-month Treasury bills or insured certificates, with a maturity not exceeding six-months, appropriate to the amounts involved." 31 C.F.R. § 515.205(g).
If the phrase "interest-bearing account" raises a red flag for federal credit unions, it is because NCUA’s Truth in Savings rule prohibits federal credit unions from offering interest-bearing deposit (as defined in in the rule) and may instead offer dividend-bearing deposit accounts. See, 12 C.F.R. § 707, Supp. I, cmt. 707.2(i)-1.
OFAC and other Treasury regulations are written in a bank-centric manner, so sometimes the language in these regulations have inadvertent construction issues. As there is no carve-out exception for federal credit unions in the section of the regulation that requires placing blocked funds in interest-bearing accounts, many credit unions have interpreted this requirement to mean a dividend-bearing account. To clarify this requirement, NAFCU contacted OFAC's compliance helpline and they agreed with the interpretation that depositing blocked property into dividend-bearing accounts would meet the requirement. However, it would be great to see this glitch clarified by NCUA or OFAC in actual guidance documents such as the NCUA AIRES Exam Questionnaire, OFAC FAQs, or the FFIEC BSA/AML Examination Manual so that federal credit unions could feel more comfortable relying on this interpretation.
As for whether the credit union has to create individual blocked property accounts or one account for all blocked property, OFAC does not have a preference as long as the credit union maintains an audit trail that allows it to determine specific ownership interest of blocked property. See, OFAC FAQs: Sanctions Compliance, Q.32.
Credit unions are also required to file a report of blocked property within 10 business days from the date that property becomes blocked. The report should detail the blocked property and also include information pertaining to payments or transfers that are rejected by the credit union because of a blocked program. See, 31 C.F.R. § 501.603(b)(1)(ii). In the initial report, the credit union must also certify that the blocked funds have been deposited into a blocked account. See, 12 C.F.R. § 501.603(b)(1)(ii).
To ensure all pertinent and required information is included in the initial report, credit unions can use the form provided by OFAC and electronically transmit it to: ofacreport@treasury.gov or mail it to: Office of Foreign Assets Control, Compliance Programs Division, U.S. Treasury Department, 1500 Pennsylvania Avenue NW.—Annex, Washington, DC 20220. Credit unions should be aware that there is a separate form for rejected transactions that follows the requirements of section 501.604.
Finally, OFAC requires that credit unions provide a comprehensive list of all blocked property held as of June 30 of the current year by September 30. See, 31 C.F.R. § 501.603. The term blocked property only applies to property that is blocked pursuant to OFAC regulations and does not include property that has been unblocked by general or specific license even if it has not yet been returned to the owner. This means that if the credit union unblocked property on June 29th and returned this property by July 1st, it should not include information on the unblocked property in its annual report. However, note that the regulation also establishes record keeping requirements for all blocked transactions for a period of 5 years after the date of the transaction. See, 12 C.F.R. § 501.601.
The annual reports must be filed using Form TD F 90-22.50, Annual Report of Blocked Property and the form should be sent to OfacReport@treasury.gov. In case of additional questions, OFAC recently updated its guidance on filling out the annual blocked property report. The guidance is especially helpful for credit unions with 20 or more blocked accounts as it allows for a spreadsheet instead of a PDF or word document to complete part B of the form.
There you have it— next time you get an OFAC hit subject to a blocking order, you hopefully won't have to go through the entire bank-centric regulation to figure out OFAC's requirements.
OFAC Enforcement: How is an Administrative Action Decided?
Willful or reckless violation of law – willfulness; recklessness; concealment; pattern of conduct; prior notice; management involvement.
Awareness of conduct at issue – actual knowledge; reason to know; management involvement.
Harm to sanctions program objectives – economic or other benefit to the sanctioned individual, entity or country; implications for U.S. policy; license eligibility; humanitarian activity.
Individual characteristics – commercial sophistication; size of operations; financial condition; volume of transactions; sanctions history.
Compliance program – risk-based compliance; consultation with regulator.
Remedial response – an immediate stop to conduct; determine the cause of conduct and extent of apparent violation; new and more effective internal controls and procedures; prevent a recurrence.
Cooperation with OFAC – voluntary self-disclosure; similar transactions; response to requests for information; tolling agreement(s).
Timing of apparent violation in relation to imposition of sanctions – date of apparent violations in relation to the adoption of the applicable prohibition(s).
Other enforcement action – other federal, state or local agencies’ actions; comprehensive settlements with other agencies.
Future compliance/deterrence effect – to promote future compliance; focus on same sector.
Other relevant factors – case-by-case basis; totality of circumstances; proportionate response.
Substantial weight is given to factors A, B, C and D in making a determination as to whether an infraction is considered egregious. There are statutory maximum penalties for OFAC violations but the amount of the base penalty can be adjusted to reflect any of the applicable general factors. Each of the 11 general factors may also be considered mitigating or aggravating thus resulting in a lower or higher proposed penalty amount. But the base or proposed penalty amount cannot exceed the statutory maximum amount. This slide presentation from the symposium provides an overview of OFAC enforcement along with a couple of case studies.
During fiscal year 2016, there were three cases involving financial institutions that resulted in OFAC issuing a Finding of Violation. Earlier this year, OFAC announced its enforcement action against Toronto-Dominion Bank (TD Bank) with a settlement agreement and Finding of Violation for the bank’s violations of the Iranian and Cuban sanctions. TD Bank is headquartered in Toronto, Canada, but the bank and its subsidiaries processed multiple prohibited transactions through the United States. The enforcement action highlights the facts and circumstances in OFAC’s determination of its administration action.
The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) held its fall symposium in Washington DC, on Wednesday, December 7th. Among the items discussed in this meeting were the recent changes to the Iran and Cuba sanctions and the elimination of the Burma and Côte d'Ivoire sanctions. As the end of the year is approaching, this is the perfect time to highlight some of OFAC’s recent activities. For a comprehensive list of active OFAC sanctions, visit the Sanctions Programs and Country Information Resource Center. Guidance documents are constantly updated so remember to check back with OFAC for up-to-date information.
Back in 2015, key nations reached a Joint Comprehensive Plan of Action (JCPOA) to ensure that Iran’s nuclear program was implemented with only peaceful intent. On January 16, 2016, the International Atomic Energy Agency (IAEA) verified Iran’s implementation of key nuclear-related measures specified in the JCPOA. Upon verification from the IAEA, the United States lifted nuclear-related sanctions on Iran. What does this mean for credit unions? The JCPOA provisions included removals of Specially Designated Nationals (SDNs) and Blocked Persons List, the Foreign Sanctions Evaders List and the Non-SDN Iran Sanctions Lists which hopefully translates to less false positives. For more information on Iran’s sanctions and the JCPOA, visit the Iran Sanctions Resource Center webpage.
46. Are authorized travelers in Cuba permitted to use credit or debit cards issued by a U.S. financial institution?
Yes. Travelers are advised to check with their financial institution before traveling to Cuba to determine whether the institution has established the necessary mechanisms for its issued credit or debit cards to be used in Cuba. See 31 CFR § 515.560(c)(5) and 515.584(c).
61. Is a financial institution required to independently verify that an individual’s travel is authorized when processing Cuba travel-related transactions?
No. A financial institution may rely on U.S. travelers to provide their certifications of authorized travel directly to the person providing travel or carrier services when processing Cuba travel-related transactions, unless the financial institution knows or has reason to know that the travel is not authorized by a general or specific license.
The [Cuban Assets Control Regulations] (CACR) requires persons subject to U.S. jurisdiction providing travel or carrier services to retain for at least five years from the date of the transaction a certification from each customer indicating the section of the CACR that authorizes the person to travel to Cuba. See § 515.572(b). U.S. travelers utilizing a general or specific license are also required to retain for five years records associated with their travel to Cuba.
For more information, guidance and resources on the Cuban Assets Control Regulations, visit the Cuba Sanctions Resource Center.
Years ago, Burma and Côte d'Ivoire were plagued with national security, human rights and other internal issues that prompted the United States to enact sanctions against these countries. After lengthy work by several international organizations both countries held successful presidential elections and moved towards the stabilization of their nations. On September 14, 2016, after the United Nations Security Council determined Côte d'Ivoire’s emergency situation was resolved, President Obama ended the sanctions program against this nation. See, Côte d'Ivoire Sanctions Resource Center. Similarly, in October 7, 2016, the President signed an Executive Order terminating the emergency with respect to the actions and policies of Burma. See, Burma Sanctions Resource Center.
My favorite quote of Wednesday’s meeting occurred when a panelist discussing the recent elimination of OFAC sanctions simplified the conversation by stating: “the sanctions for Burma and Côte d'Ivoire are over, let’s just move on.” For credit unions, this means these two countries can now participate in financial markets again which may mean an increase in wire transfers to and from these countries.
When identifying names on the SDN or other lists, it may be necessary to search more than just OFAC provided information or resources. This is where the credit union’s risk assessment and subsequent due diligence is key in determining its policies and procedures.
If unsure, ask! OFAC has published many resources such as interpretative documents and FAQs to its sanctions programs. It also has an OFAC Compliance Hotline ready to assist. The speakers did emphasize the need for credit unions to provide as much detail as possible when submitting questions to the helpline, especially if the credit union wants to receive a timely response. You can find the contact information for the Hotline here.
Compliance with Bank Secrecy Act (BSA) and the Office of Foreign Assets Control (OFAC) requirements continues to be an issue for some financial institutions. Towards the end of 2015, the Board of Governors of the Federal Reserve System posted enforcement actions against three banks: The Bank of Nova Scotia of Toronto, Canada; East West Bank of Pasadena, California; and Habib Bank Limited of Karachi, Pakistan. Each bank had varying degrees of problems with its BSA and anti-money laundering (AML) compliance programs as well as OFAC compliance. All are now subject to monitoring, reporting and transaction lookback review as a result of the deficiencies. It is sometimes helpful to review what someone else has or is doing wrong to ensure your own compliance program is up to snuff.
Frequently Asked Questions Relating to the Lifting of Certain U.S. Sanctions Under the Joint Comprehensive Plan of Action (JCPOA) on Implementation Day.
BSA Blast: The January 2016 quarterly issue of the BSA Blast is now available (a NAFCU login required). This issue takes a look at the enforcement actions against Deutsche Bank AG for U.S. sanctions violations and reviews recent speeches made by the Financial Crimes Enforcement Network Director Jennifer Shasky Calvery. The issue also includes a new BSA quiz for staff training on OFAC reporting and record keeping requirements.
Programming Note: Winter Storm Jonas is coming so NAFCU is closing at 12 noon today to ensure folks get home safely. But never fear, for those not impacted by Jonas, the Regulatory Compliance team will still be available to answer your questions remotely.
A recent enforcement action by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has resulted in the issuance of new guidance concerning false hits lists. OFAC issued a Finding of Violation against BMO Harris Bank NA as the successor to Marshall and Ilsley Bank (M&I), in connection with M&I’s processing of six funds transfers totaling $67,357 in violation of the Iranian transactions and sanctions regulations.
Apparently M&I’s customer was a company that specialized in carpets and the company name included the word “Persian” in its name. The funds were to pay an outstanding balance to an entity in Iran for the purchase of Iranian-origin carpets. The company had been a customer of M&I since 2009 when importing Iranian carpets was still allowed. M&I had added the company to its “False Hit List” on May 29, 2009, after its OFAC interdiction software generated multiple alerts due to the word “Persian.” But M&I never updated its procedures after importing Iranian-origin carpets was no longer allowed after September 29, 2010.
For direct customers who have an entry on a false hit list, ensuring that any meaningful changes to the customer’s information (e.g., a change in ownership status, business activity, address, date of birth, place of business, etc.) trigger a review of the false hit list entry.
In other words, make sure if you create and use a false hit list, also make certain you have a policy and internal procedures in place to ensure that it doesn’t remain static.
You may not realize from my name that I am Irish through and through – recently took a little trip to Dublin and Galway. Ireland is full of red heads, music and Guinness! Oh, and you might recognize my traveling companion in the last photo!
As Alicia mentioned on Friday, the CFPB finalized changes to HMDA on Thursday, October 15th. Most of the rule such as new data points will not become effective until January 2018. However, the definition of “financial institution” is changing effective January 1, 2017 to incorporate one prong of the “institutional coverage” test, so I thought I would highlight that today and keep the blog short for a Monday morning.
See p. 653 of the final rule.
See p. 695 of the final rule.
NAFCU is working on a Final Regulation summarizing key parts of the rule that will be made available to members within a couple of weeks.
BSA Blast. The October 2015 quarterly issue of the BSA Blast is now available for NAFCU members (member login needed). This quarter, we review how the Department of Treasury’s Office of Foreign Assets Control’s final rule amending the Cuban sanctions changes things for financial institutions. In addition, there is a new BSA quiz on Anti-Money Laundering compliance programs and Bank Secrecy Act reporting that can be used for staff training.
One of the biggest news stories to hit the airwaves recently was that of President Obama’s announcement of major changes in U.S. policy with respect to Cuba. The key elements of the executive actions to re-frame U.S. relations with Cuba concern: 1) re-establishing diplomatic relations, including re-establishing an embassy in Havana; 2) easing the regulatory hurdles to travel to Cuba; and 3) expanding and authorizing trade and financing. Financial institutions can expect changes in two areas as a result of the policy changes, remittances and correspondent accounts.
Remittance levels will be raised from $500 to $2,000 every three months for general remittances to Cuban nationals (excluding certain officials of the government or the Communist party). Remittance forwarders, as well as donations for humanitarian projects or private businesses, will no longer require a specific license.
“Q. How will OFAC implement the changes to the Cuba sanctions program announced by the President on December 17, 2014? Are the changes effective immediately?
In addition, anyone looking for email updates on Cuba sanctions can sign-up here.
The consolidation upgrade was done to reduce the number of list-related files needed to be downloaded so as to maintain an automated sanctions screening program. When appropriate, OFAC also will add any new data associated with any sanctions list created where the required action of a U.S. person does not necessarily entail blocking to the consolidated data files. OFAC’s changes are meant to ensure that all of the sanctions list records are included in its Sanctions List Search tool. This tool allows users to search for a name on the SDN lists and the consolidated list.
In approximately six months, OFAC will stop issuing independent files for the FSE, SSI and NS-PLC lists. During this transition period OFAC will still produce the data both on the individual lists and the consolidated list. And, OFAC will continue to provide and update .pdf and .txt versions of the FSE, SSI, NS-ISA, NS-PLC and Part 561 lists and their respective archive of changes files. These file formats will continue to be available even after the transition period.
​​​NCUA Board Actions. Yesterday, the NCUA Board issued two proposed rules. The first would implement 2014 statutory changes to flood insurance measures affected by the Biggert-Waters Flood Insurance Act. The second updates and technically revises the agency’s rules on corporate credit unions. In addition, NCUA staff told the NCUA Board there will be no share insurance premium assessment for 2014. There will soon be a NAFCU blog post breaking down the flood insurance proposal, so stay tuned!
Three Short Ones: NCUA Grants to Tornado Victims, AML Webinar, and Fair Lending Webcast.
Low-income credit unions affected by the tornados in the South and Midwest can apply for emergency assistance grants to repair damages or replace equipment to restore services to members. Low-income credit union can obtain more information about Urgent Needs Grants by clicking here, or can email the Office of Small Credit Union Initiatives at OSCUImail@ncua.gov.
On Wednesday, May 21, 2014, at 2 p.m. EST, NCUA will be hosting the first of two free webinars titled: “How to Be in Compliance with OFAC and FinCEN.” The webinars will provide an overview of OFAC’s and FinCEN’s programs, their enforcement authorities, and their relationships with other regulators. In addition, participants may receive a certificate of attendance if they individually participate in the survey offered during the webcast and take a short quiz at the end of the webcast.
Online registration is now open, and the link to the registration page can be found here. Participants may also submit questions in advance to WebinarQuestions@ncua.gov.
Receive important tips regarding how to optimize your fair lending compliance program, plus get updated on the headline-making indirect auto fair lending investigations and enforcement actions. To find out more information regarding this webcast, click here.
OFAC has improved its SDN search tool by employing what it calls “fuzzy logic” on its name search field. Fuzzy logic uses character, string, and phonetic matching when returning results from an SDN search. The other fields on the tool use only character matching.
The search tool and the FAQs on it can be found here.
If you’ve never used OFAC’s SDN search tool before, try it out. I did! And thankfully the whole compliance team here at NAFCU came out match-free! Phew!
Below are a couple of quick items for your Thursday.
ATM Fee Update. Yesterday, the ATM Fee disclosure bill, H.R. 4367, passed the House Financial Services Committee and will now move on to the full House. NAFCU is also urging the Senate to act on a similar bill, S. 3204.
NCUA Grants. Low-income credit unions have until tomorrow - June 29th - to apply for technical assistance grants and reduced-rate loans. Remember, the grants can be used for staff, official and director training. If you are a low-income credit union, be sure to review the application process soon.
Archive of June 14 Call-In. The archived version of NAFCU's mid-year Member Call-In is available online. The live version was conducted on June 14th. If you need to get caught up on the multitude of issues impacting credit unions, this is a good way to do so.
Current Issues in Credit Unions. I had the pleasure of being a guest on Episode 72 of the Current Issues in Credit Unions podcast. We talked about the CFPB; CUSOs; OFAC; Twitter and a few other items that might be interest.
Additionally, NAFCU will be hosting a live taping of Current Issues in Credit Unions podcast from our Regulatory Compliance Seminar (October 23-26 in Seattle). We hosted the first live podcast last year in Orlando (Episode 64) and we are very glad that Rob Rutkowski and Katherine Weber will be back live for the podcast in Seattle.
Yesterday, June 12th, 2012, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced a settlement with ING Bank N.V. (ING Bank) for potential violations of U.S. sanctions in the amount of $619 million, the largest OFAC settlement of any kind to date. The settlement resolves OFAC’s investigation into ING Bank’s intentional and systemic violation of U.S. sanctions. In light of this monumental settlement, I thought it might be useful to highlight some guidance on OFAC compliance programs.
“25. Does OFAC itself require that banks set up a certain type of compliance program?
While not required by specific regulation, but as a matter of sound banking practice and in order to ensure compliance, banks should establish and maintain an effective, written OFAC compliance program commensurate with their OFAC risk profile (based on products, services, customers, and geographic locations). The program should identify higher-risk areas, provide for appropriate internal controls for screening and reporting, establish independent testing for compliance, designate a bank employee or employees as responsible for OFAC compliance, and create training programs for appropriate personnel in all relevant areas of the bank. A bank’s OFAC compliance program should be commensurate with its respective OFAC risk profile.” (emphasis added).
The FFIEC BSA/AML Examination Manual OFAC Overview provides a very good summary of NCUA’s expectations concerning OFAC compliance, I would suggest taking a look through it if you have not already. OFAC compliance is sure to continue to be a hot topic with NCUA in examinations, and as this U.S. Treasury settlement with ING Bank shows, non-compliance can be costly.
NAFCU's BSA Webcast. Now is the perfect time to get your annual BSA training. Check our NAFCU's June 27th webcast: BSA for Compliance Experts. Sign up by June 20 to Save $100!
OFAC has announced the release of SDN Search. This is an online search tool that allows the user to search the SDN list. Of course OFAC maintains in the fine print that searches are conducted at the risk of the user and use of the tool does not constitute an official confirmation on its part of the existence (or nonexistence) of a match.
NCUA's Office of Small Credit Union Initiatives (OSCUI) has announced its first free training video. OSCUI is planning a series of training videos, and this is the first in the series. This video is a bit of an overview of the role of the office within NCUA, and various programs that are available to small credit unions. The announcement details how credit unions may access the video, online or via DVD.
NAFCU held its year-end member call-in yesterday. The call-in is free for members and is a great way to catch up on what NAFCU is up to. If you weren't able to tune in yesterday it will be available on the website in a few days. The call provided legislative, regulatory and economic updates, including a look ahead to what to expect in 2012. Topics included tax reform, Richard Cordray's CFPB nomination blocked by the Senate, MBL and data security legislation; the status and activities of NCUA and the CFPB; and Steve discussed a few hot compliance topics including member online authentication guidelines, ADA and ATMs, and NCUA's advertising rule.
NAFCU members, our December Compliance Monitor is now available, and includes an article on free checking analysis.
Does the CFPB even need a director? Last week, I would have said that the answer to that question was quite clear. Today, I'm not so sure.
When U.S. Congressmen voted on the Dodd-Frank legislation regarding the CFPB, it was understood that the new agency would be run by a director that had to pass through the Senate confirmation process. That was a very important concept, because those Congressmen who were on the fence about whether the new CFPB would have too much power could calm their fears knowing that the Director was subject to confirmation. If a possible director had some flaw or had ideas that made too many Senators uncomfortable, that person would not be confirmed, or more likely - would not even be put forward into the confirmation process.
This development is a bit troubling. Having a Senate-confirmed director is a well-designed example of "checks and balances." Anyone who sat in Civics 101 can tell you that the fewer checks and balances you have, you'll see a greater likelihood for shenanigans. Checks and balances: good. Shenanigans: bad. I know that a Director will eventually be named, but the longer the CFPB is allowed to function without one…well…shenanigans. That’s all I can say.
Am I required to screen for weak aliases (AKAs)?
OFAC’s regulations do not explicitly require any specific screening regime. Financial institutions and others must make screening choices based on their circumstances and compliance approach. As a general matter, though, OFAC does not expect that persons will screen for weak AKAs, but expects that such AKAs may be used to help determine whether a “hit” arising from other information is accurate.
Will I be penalized for processing an unauthorized transaction involving a weak alias (AKA)?
A person who processes an unauthorized transaction involving an SDN has violated U.S. law and may be subject to an enforcement action. Generally speaking, however, if (i) the only sanctions reference in the transaction is a weak AKA, (ii) the person involved in the processing had no other reason to know that the transaction involved an SDN or was otherwise in violation of U.S. law, and (iii) the person maintains a rigorous risk-based compliance program, OFAC will not issue a civil penalty against an individual or entity for processing such a transaction.
As we look toward 2011, here's another thought. Read.
A good compliance officer has to devote some time each day for reading. The reading list might include new regulations, guidance documents, blog postings, newsletters, and the like. Background reading is a must. If you ignore it long enough, you'll eventually say things such as..."When did NCUA issue that?" Hopefully not last year.
Turn off the phone, and shut your door. Give yourself the right reading environment, or the time you spend reading may end up being time wasted.
Perhaps one day a week, come in early. I've found that I can accomplish more between the hours of 6 and 9 a.m. than I can the rest of the day.
If something is interesting, but not time sensitive, add it to a reading list or pile. When time presents itself, which may be in 2014, pick up the pile and start digging through it.
I don't think you'll ever have enough hours in the day to read everything that you want, but the more time and effort you can devote to this task, the better off you'll be.
OFAC. They recently issued civil money penalties against two financial institutions.
Regulation Z. Last week the Fed issued an interim final rule to clarify a few issues regarding another recent interim final rule regarding MDIA requirements.
Interchange. Hey NAFCU members, we've created an overview of the Fed's recent proposal concerning debit card interchange fees.
I think the days of lazy summers for compliance officers are over, if they ever existed. People like to hold on to myths, and I think this is one of them.
I think we should all be nice to anyone responsible for mortgage compliance issues.
I think we should impose a page limitation on proposed regulations. If you can't get it done in 200 pages, perhaps the document is a wee bit complicated for general consumption.
I think that regulators expect a lot when they issue five rule-makings in one day. It is hard to comply with things when there isn't enough time in the day to read proposals, let alone analyze them.
Now that I think about it, I think there should be an issue limit on top of the "page limit" for regulators. It is impossible for organizations to comply with scores of new laws, regulations and guidance documents when they are issued on top of each other. I wonder what our world would be like if each regulator was only allowed to issue five major rule-makings or guidance documents each year?
I think regulators should point to existing guidance documents first whenever possible, rather than creating new documents. If existing guidance is adequate, enforce it.
I think that's enough thinking for today.
Regulation and the cost of credit. We warned folks that added layers of consumer protection and regulatory restrictions would drive up the cost of credit. It looks like we may be right. Your honor, I'd like to enter into evidence Exhibits One (CNN.com) and Two (WSJ.com).
OFAC. A bank has paid roughly $92,000 to settle claims of OFAC violations. The original fine was more than $200,000, but the bank self-reported the violation. I'm seeing an up-tick of OFAC violations. It is hard to know whether this is a general trend or whether the issues were specific to the affected financial institutions. In any event, it is something to track.
Reg Z. The Fed issued Consumer Affairs letter CA 10-10 to announce bank examiner procedures for the August 22, 2010 Reg Z changes.
This week, Representative Barney Frank introduced two bills that would ease burdens on financial institutions in the area of internet gambling. Read all about it here. I thought you might like to read about efforts to take stuff off of our plates.
You may have heard FDIC Chairman Sheila Bair talk about the creation of a national systemic risk council. NCUA Chairman Fryzel isn't against the idea, as long as NCUA keeps its independence.
Hey NAFCU members: We put together a contact sheet to help you reach us. It contains all the relevant email addresses and phone numbers. Download Contacting NAFCU Compliance. It also contains advice to ensure you get what you need. Enjoy, enjoy!
I love FAQ's. Especially OFAC's. For example, what do you do when someone who is on the SDN list tries to open an account at your credit union? Check out the answer.
Mandy and I celebrate our first anniversary this weekend. Holy cow! What a difference a year can make.
"Absolutely!" is the best answer to any question from your spouse.
Children are a blessing. An expensive, sleep-depriving blessing.
Life can exist without a daily dose of ESPN.
I should buy stock in any company that makes diapers or baby formula.
I never thought getting someone else to burp would play such a major part in my day.
For all you moms, Happy Mother's Day! Enjoy your weekend, stay safe, and stay compliant.
Yesterday, FinCEN released its latest mortgage fraud analysis. In short, SARs filed on suspected mortgage fraud increased 44 percent in the 12 months ending in June 2008.
Access the FinCEN report here. If your credit union does mortgage lending, this would be a good read.
OFAC has issued an FAQ regarding financial institutions' obligations with regard to property that is owned, directly or indirectly, 50% or more by persons whose property and property interests in property are blocked pursuant to an Executive Order or regulations administered by OFAC. Access it here.
On Monday, OFAC published new enforcement guidelines in the federal register. You can access them here. These guidelines supersede earlier enforcement guidelines issued in 2003 and 2006. The are effective immediately.
In short, OFAC wanted to share the process it navigates when it decides whether to punish an entity for OFAC violations, or whether to do anything at all. From my reading, these guidelines are designed to reward institutions with strong OFAC compliance programs, and especially those that voluntarily disclose the violation to OFAC. Conversely, those violations that are deemed to be reckless, willful, etc., will be treated more harshly. An egregious case (yes, that's defined) where there was no voluntary self-disclosure could end up with a $250,000 penalty.
If you are in charge of your credit union's OFAC program, this is a must read.
Other blog postings on OFAC.
The BSA Manual's OFAC Chapter.
1) Countries subject to OFAC sanctions, including state sponsors of terrorism.
2) Countries identified as supporting international terrorism under section 6(j) of the Export Administration Act of 1979, as determined by the Secretary of State.
3) Jurisdictions determined to be "of primary money laundering concern" by the Secretary of the Treasury, and jurisdictions subject to special measures imposed by the Secretary of the Treasury, through FinCEN, pursuant to section 311 of the Patriot Act.
4) Jurisdictions or countries identified as non-cooperative by the Financial Action Task Force on Money Laundering (FATF).
5) Major money laundering countries and jurisdictions identified in the U.S. Department of State's annual International Narcotics Control Strategy Report (INCSR), in particular, countries which are identified as jurisdictions of primary concern.
6) Offshore financial centers (OFCs) as identified by the U.S. Department of State.
I'd be curious to know how many credit unions use dollar thresholds in their OFAC compliance program. Dollar thresholds seem to be a logical way to build risk-based internal controls that control OFAC-related risk.
For example, if a member wants to get a cashier's check for $1, would you check the name of a non-member payee against the OFAC SDN list? What if the check was for $10? Or $100? or $1,000? If I am allowed to build risk-based policies and procedures, it might seem reasonable to limit SDN reviews to items above a certain threshold. And the 2007 BSA/AML Examiner's Manual indicates that it is every credit union's duty to build risk-based policies and procedures, based on their risk profile. Here's the Manual's OFAC Chapter. That being said, I am not aware that any regulator has publicly blessed the threshold system.
And OFAC is quick to point out that their requirements apply to every transaction, regardless of dollar amount. Here's their Q and A that addresses this issue. And just to add to the puzzle, in 2006, OFAC released these enforcement guidelines. (Note that OFAC retains enforcement authority for its regulatory regime.) The guidelines seem to imply that should OFAC see a violation of its rules, it will review the strength of the institution's compliance program before it decides whether to start an enforcement action.
One more thought: does one want to risk their reputation by showing up in an OFAC enforcement action?
At the end of the day, compliance officers are left in the middle. When they look to the right, they see the strict liability of OFAC requirements. When they look to the left, they see their ability to craft risk-based policies and procedures. It isn't a fun place to be.
I wish I had an easy answer on this one. Feel free to weigh in.
If you ever wondered how powerful the OFAC SDN List is, all you had to do is read a Treasury Press Release issued earlier this week.
The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) today removed from its list of Specially Designated Narcotics Traffickers 60 individuals who, since their designation, have severed ties with Colombia's notorious Cali drug cartel and are assisting Colombian authorities. All 60 individuals are Colombian employees of Copservir, a previously-designated enterprise that operated a retail drugstore chain before the Colombian government seized control of its operations in September 2004.
"Removing the names of these Copservir employees from the list of Specially Designated Narcotics Traffickers is the result of close cooperation with the Colombian government," said OFAC Director Adam J. Szubin. "Today's action represents a success in OFAC's targeting of Colombian drug cartels, as these 60 individuals have cut ties with the Rodriguez Orejuela narcotics trafficking organization and have instead cooperated with the Colombian authorities during the forfeiture process."
You can access the press release here. As you can see, no one wants to be on this list. It has the effect of helping individuals decide to cooperate with law enforcement. In 2007, OFAC published this study which showed the impact of its sanctions on the drug cartels. (Please note: the study is almost 18 MBs in size!) If you have time, this study does a good job of showing the isolation effect of appearing on the SDN list. In one situation, authorities placed a soccer team, which was owned by a suspect, on the list.
(I)n November 2006, within 72 hours of the designation of the soccer team Cortulua, the team’s president and three of its five board members resigned, sponsors withdrew their support, and key business partners publicly announced the severing of all commercial ties with the team.
Amazing. Can you imagine this bar conversation?
Fan #1: Man, my team really stinks right now. We just can't score goals, and our defense is terrible.
Fan #2: Stop complaining. My team was just placed on the SDN list.
Read other OFAC related blog entries here.
When a credit union gets an "OFAC hit," the following question quickly surfaces: Now what??!!
OFAC, in its frequently asked questions section, explains what you should do to determine if you have a valid "OFAC Match." You can access it here. The guidance does a good job of methodically laying out what you should do, step-by-step. Access other OFAC postings here.
News flash: Yesterday the Federal Reserve and the FTC issued the long-awaited proposal concerning risk-based pricing notices. You can access a press release (which will give you access to the proposal) here. Once it is published in the Federal Register, we'll have 90 days to comment. I haven't had a chance to read through it. In fact, as I type this, I'm waiting for She Who Must Be Obeyed to finish packing before we head down to Syria, Virginia for our wedding!
One of my countless compliance discussion groups turned up a potential gem. What if I told you that there is a a website that provides a free, searchable OFAC SDN List database. That's right. Free. Would you believe me? You should.
Please check the disclaimer for the website, which you may access here. The website is not affiliated with the U.S. Treasury Department, or any other government agency. Information retrieved from searches conducted on the website contains information made available from directly within the public domain of OFAC and is not altered. OFAC and NCUA have not endorsed the product.
That being said, credit unions should take a look at the website to see if using it makes sense. And you can't beat the price.
I helped present a webcast yesterday. Here's a tip from a viewer that is worth sharing.
"I wanted to make a suggestion to credit unions regarding OFAC scans and was thinking maybe you could help share it. So many CUs ask about how often they should scan their members, or even their vendor lists. My suggestion to everyone is to scan your membership (and other lists) when the lists change, not necessarily on a specific, periodic basis. For example, yesterday the terrorists lists were updated. This morning, I scanned our membership and vendor lists after ensuring our scanning software had been updated. Obviously transactions need scanned much more promptly."
That seems to be a sound, risk-based procedure.
"The SAR rules require that a SAR be filed no later than 30 calendar days from the date of the initial detection of facts that may constitute a basis for filing a SAR. If no suspect can be identified, the time period for filing a SAR is extended to 60 days." 2007 FFIEC BSA/AML Examination Manual.

References: § 515
 § 515
 § 707
 § 501
 § 501
 § 501
 § 501
 § 515
 § 515