Source: https://www.fdic.gov/news/news/press/2007/pr07061a.html
Timestamp: 2019-04-23 07:57:19+00:00

Document:
Communication of Supervisory Concerns about BSA Compliance Programs.
a finding contained in the report of examination or in other formal communications from the Agency to an institution's board of directors of a violation of the regulatory requirement to implement and maintain a reasonably designed BSA Compliance Program.
As explained below, in order to be a "problem" with the BSA Compliance Program that will result in a cease and desist order under sections 8(s) or 206(q) if not corrected by the institution, deficiencies in the Program must be identified in a report of examination or other written document as requiring communication to an institution's board of directors or senior management as matters that must be corrected. However, other issues or suggestions for improvement may be communicated through other means.
Enforcement Actions for BSA Compliance Program Failures.
In accordance with sections 8(s)(3) and 206(q)(3), the appropriate Agency will issue a cease and desist order against a banking organization or a credit union for noncompliance with BSA Compliance Program requirements in the following circumstances, based on a careful review of all the relevant facts and circumstances.
For example, an institution that has procedures to provide BSA/AML training to appropriate personnel, independent testing, and a designated BSA/AML compliance officer, would nonetheless be subject to a cease and desist order if its system of internal controls (such as customer due diligence, procedures for monitoring suspicious activity, or an appropriate risk assessment) fails with respect to a high risk area or to multiple lines of business that significantly impact the institution's overall BSA compliance. Similarly, a cease and desist order would be warranted if, for example, an institution has deficiencies in the required independent testing element of the Program and those deficiencies are coupled with evidence of highly suspicious activity creating a significant potential for unreported money laundering or terrorist financing in the institution. However, other types of deficiencies in an institution's BSA Compliance Program or in implementation of one or more of the required Program elements will not necessarily result in the issuance of a cease and desist order, unless the deficiencies are so severe as to render the Program ineffective when viewed as a whole. For example, an institution that has deficiencies in its procedures for providing BSA/AML training to appropriate personnel, but has effective controls, independent testing, and a designated BSA/AML compliance officer, may ordinarily be subject to examiner criticism and/or supervisory action other than the issuance of a cease and desist order, unless the training program deficiencies, viewed in light of all relevant circumstances, are so severe as to result in a finding that the organization's Program, taken as a whole, is not effective.
In determining whether an organization has failed to implement a BSA Compliance Program, an Agency will also consider the application of the organization's Program across its business lines and activities. In the case of institutions with multiple lines of business, deficiencies affecting only some lines of business or activities would need to be evaluated to determine if the deficiencies are so severe or significant in scope as to result in a conclusion that the institution has not implemented an effective overall program.
Failure to correct a previously reported problem with the BSA Compliance Program. A history of deficiencies in an institution's BSA Compliance Program in a variety of different areas, or in the same general areas, may result in a cease and desist order on that basis. An Agency will, in accordance with sections 8(s) and 206(q), and based on a careful review of the relevant facts and circumstances, issue a cease and desist order whenever an institution fails to correct a problem with BSA/AML compliance identified during the supervisory process. In order to be considered a "problem" within the meaning of sections 8(s)(3)(B) and 206(q)(3)(B), however, a deficiency reported to the institution ordinarily would involve a serious defect in one or more of the required components of the institution's BSA Compliance Program or implementation thereof that a report of examination or other written supervisory communication identifies as requiring communication to the institution's board of directors or senior management as a matter that must be corrected. For example, failure to take any action in response to an express criticism in an examination report regarding a failure to appoint a qualified compliance officer could be viewed as an uncorrected problem that would result in a cease and desist order.
The Agencies recognize that certain types of problems with an institution's BSA Compliance Program may not be fully correctable before the next examination, for example, remedial action involving adoption or conversion of computer systems. In these types of situations, a cease and desist order is not required provided the Agency determines that the institution has made acceptable substantial progress toward correcting the problem at the time of the examination immediately following the examination where the problem was first identified and reported to the institution.
Other Enforcement Actions for BSA Compliance Program Deficiencies. As noted above, in addition to the situations described in this Statement where an Agency will issue a cease and desist order for a violation of the BSA Compliance Program regulation or for failure to correct a previously reported Program "problem," an Agency may also issue a cease and desist order or enter into a formal written agreement, or take informal enforcement action against an institution for other types of BSA/AML Program concerns. In these situations, depending upon the particular facts involved, an Agency may pursue enforcement actions based on unsafe and unsound practices or violations of law, including the BSA. The form of the enforcement action in a particular case will depend on the severity of the noncompliance, weaknesses, or deficiencies, the capability and cooperation of the institution's management, and the Agency's confidence that the institution will take appropriate and timely corrective action.
suspicious transactions of $5,000 or more that involve potential money laundering or BSA violations.
The SAR must be filed within 30 days of detecting facts that may constitute a basis for filing a SAR (or within 60 days if there is no subject).
The Agencies will cite a violation of the SAR regulations, and will take appropriate supervisory action, if the organization's failure to file a SAR (or SARs) evidences a systemic breakdown in its policies, procedures, or processes to identify and research suspicious activity, involves a pattern or practice of noncompliance with the filing requirement, or represents a significant or egregious situation.
Other BSA Reporting and Recordkeeping Requirements. Banking organizations and credit unions also are subject to other BSA reporting and recordkeeping requirements set forth in regulations issued by the Treasury Department.9 These requirements are reviewed in detail in the FFIEC BSA/AML Examination Manual; they include, inter alia, requirements applicable to cash and monetary instrument transactions and funds transfers, Currency Transaction Report ("CTR") filing and exemption rules, and due diligence, certification, and other requirements for foreign correspondent and private banking accounts.
Enforcement Actions for Non-Program BSA/AML Requirements.
In appropriate circumstances, an Agency may take formal or informal enforcement actions to address violations of BSA/AML requirements other than the BSA Compliance Program requirements. These other requirements include, for example, the SAR and CTR regulatory obligations described above.
1 This statement is intended to set forth general policy guidance. It is not intended to compel or preclude an enforcement or other supervisory action as necessary in a specific factual situation.
2 Collectively the "Agencies" or individually, "Agency."
3 This Statement does not address the assessment of civil money penalties for violations of the BSA or its implementing regulations. The Financial Crimes Enforcement Network ("FinCEN") has authority to assess such penalties under the BSA. Likewise, the Agencies also have such authority under their general enforcement statutes. 12 U.S.C. §§ 1818(i)(2), 1786(k)(2).
4 12 U.S.C. § 1818(s); 12 U.S.C. § 1786(q).
5 12 C.F.R. §§ 21.21 (OCC); 208.63 (Board of Governors); 326.8(c) (FDIC); 563.177 (OTS); 748.2 (NCUA). The provisions of section 8(s) are also made applicable to certain banking organizations other than insured depository institutions. 12 U.S.C. §§ 1818(b)(3), (b)(4). The OCC's regulations also apply to Federal branches and agencies of foreign banks. 12 U.S.C. § 3102(b); 12 C.F.R. § 28.13. The Federal Reserve's regulations also apply to Edge and agreement corporations, and branches, agencies, and other offices of foreign banking organizations. 12 C.F.R. §§ 211.5, 211.24. BSA Compliance Programs that comply with these Agency regulations are also deemed to comply with Treasury regulations issued pursuant to the BSA, which separately requires that financial institutions establish AML programs. See 31 C.F.R. § 103.120(b); 31 U.S.C. § 5318(h).
6 12 C.F.R. §§ 21.21(b)(2) (OCC); 208.63(b)(2), 211.5(m)(2), 211.24(j)(2), (Board of Governors); 326.8(b)(2) (FDIC); 563.177(b)(2) (OTS); 748.2(b)(2) (NCUA); 31 C.F.R. § 103.121.
7 These examples do not in any way limit the ability of an Agency to bring an enforcement action where the failure to have or to implement a BSA Compliance Program is demonstrated by other deficiencies.
8 12 C.F.R. §§ 21.11 (OCC); 208.62, 211.5(k), 211.24(f), 225.4(f) (Board of Governors); Part 353 (FDIC); 563.180(d) (OTS); 748.1(c) (NCUA); 31 C.F.R. § 103.18 (Treasury).
9 31 C.F.R. Part 103.

References: § 1818
 § 1786
 § 3102
 § 28
 § 103
 § 5318
 § 103
 § 103