Bates Research | 05-14-20
AML Compliance Report: FinCEN Says Hold the Line, FFIEC Updates Exam Manual
At a time when regulators are emphasizing their understanding of, and flexibility concerning, the difficulties facing financial firms as a result of COVID-19, the Financial Crimes Enforcement Network (FinCEN) and the umbrella Federal Financial Institutions Examination Council (FFIEC) are demanding robust compliance with Bank Secrecy Act/ Anti-Money laundering (BSA/AML) requirements. Since Bates’ last report in which FinCEN highlighted warnings about bad actors finding opportunities created by the volatility and fear in the markets, the Network issued additional compliance information to its previous alert, and FFIEC published a long-anticipated update to its BSA/AML Examination Manual. Here are some of the details.
FinCEN Says Hold the Line
Last month, FinCEN issued its second Notice within a month concerning compliance with BSA/AML obligations during the pandemic. While it “appreciate[s]” the challenges financial firms are confronting as a result of the coronavirus, FinCEN reminded the firms that such compliance is “crucial to protecting our national security” and that the agency “expects financial institutions to … diligently adhere to their BSA obligations.”
Beyond that overarching message, FinCEN urged that financial firms stay the course in developing their risk-based compliance programs. In addition, FinCEN provided specific direction for making it easier to support pandemic-related programs and offered other tweaks for easing some compliance challenges.
First, FinCEN advised that loans disbursed to existing customers under the Paycheck Protection Program (PPP) of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) do not require re-verification under existing BSA requirements unless flagged by the institution under its risk-based approach. (Existing customers already undergo verification with BSA requirements.) In addition, FinCEN made note of previously limited relief from beneficial ownership requirements for non–PPP-related loans under certain circumstances. (See the Small Business Administration FAQs on beneficial ownership obligations under the CARES Act that FinCEN published on April 13, 2020.)
Second, FinCEN advised that it suspended implementation of a recent rule change scheduled to take effect on April 6, 2020, concerning the use of Currency Transaction Reports forms involving sole proprietorships and entities operating under a “doing business as” (DBA) name. FinCEN stated that financial firms reported difficulty in meeting the implementation timetable.
Third, FinCEN announced a new online contact mechanism for firms to convey COVID-19–related BSA compliance issues. FinCEN also reminded firms to contact “their functional regulator(s) or other BSA examining authority as soon as practicable” concerning BSA compliance concerns.
The Office of the Comptroller of the Currency (OCC) followed up the FinCEN Notice with a Bulletin of its own. OCC offered full support for FinCEN’s risk-based approach to BSA compliance, and actions described earlier, as a reasonable response to pandemic-related concerns. OCC stated that it will take into consideration “the actions taken by banks to protect and assist employees, customers, and others in response to the COVID-19 pandemic, including any reasonable delays in BSA report filings, beneficial ownership verification or re-verification requirements, and other risk management processes” when evaluating a firm’s compliance program. Presumably, that would apply to penalties for violations as well.
FFIEC Updates Examinations Manual
On April 15, 2020, FFIEC, the council of federal and state regulators that includes the Federal Reserve Board of Governors, the Federal Deposit Insurance Corporation, OCC, the National Credit Union Administration, the Consumer Financial Protection Bureau, and the State Liaison Committee, announced updates to its manual on BSA/AML compliance examinations. The publication is the instruction manual examiners use for overseeing compliance by financial institutions with regulatory requirements and supervision.
In its joint interagency statement, FFIEC explained that the latest revisions enhance the risk-focused approach to BSA/AML supervision. The regulators were keen on ensuring that evaluations of BSA/AML compliance programs are based on an institution’s risk profile for money laundering, terrorist financing, and other illicit financial activities. The revisions were also meant to clarify language that “distinguishes between mandatory regulatory requirements and supervisory expectations set forth in guidance.” That said, FFIEC stated that the revisions do not add new requirements.
Specifically, the revisions concern (i) risk profile supervision, testing, and analysis; (ii) adequacy of a compliance program (with sections on internal controls, independent testing, and training, among others); and (iii) adequacy of the risk assessment process, including, bank-related risk categories and risk analysis. The new revisions emphasize the built-in flexibility over the design of BSA/AML compliance programs, risk assessments methods, and formats. In addition, the instructions relay to examiners that risk assessment updates do not have to be regular but rather should be aligned and reflect any changes to a bank’s risk profile.
Conclusion
Despite its second notice providing BSA/AML compliance guidance to financial firms during COVID-19, FinCEN is not offering much relief. If anything, the agency is doubling down on its direction to financial firms that they protect against the increased risks presented by bad actors during this time (i.e., the first Notice imploring that firms continue aggressively monitoring and filing SARs reports), and has offered various tweaks for speeding up the PPP application process or postponing implementation of beneficial owner rules (the second Notice). When placed in context, FinCEN appears to be demanding that financial institutions up their game at a time when those very institutions are dealing with staff and resource constraints including staff operating under quarantine conditions.
FFIEC’s Examination Manual remains the most definitive source for regulators to measure the adequacy of BMA/AML compliance. The revisions recommend a detailed review to ensure that a firm is implementing its risk-based approach in full. Put another way, significant penalties may hang in the balance.
In addressing these issues, Edward Longridge, Managing Director of Bates AML & Financial Crimes, points out that “[d]uring these challenging times with Coronavirus, the regulatory establishment is requiring increased efforts of BSA/AML managers over their programs, particularly related to COVID-19 scams and other types of fraudulent and money laundering activity. The expectation is for BSA/AML programs to step up to meet the challenge posed by bad actors.”
Bates will continue to monitor developments and keep you apprised.
For additional information, please follow the links below to Bates Group’s Practice Area pages:
Bates AML and Financial Crimes
Regulatory and Internal Investigations
Retail Litigation and Consulting