We have finally identified all of our High Risk and Moderate Risk Deposit Accounts for our BSA Monitoring. So, how often should we be looking at these accounts, what type of monitoring should we be doing, etc. I appreciate any help you can provide, thanks a lot.

Great job with identifying all your high-risk accounts – you are already ahead of several other banks. One way to work with these accounts would be to develop a “risked based’ monitoring program. Begin by writing a program that outlines (1) how you identify high, medium, and low risk accounts, (2) what amount of investigation is required for each category, and (3) how often you will review these accounts. Using a reasonable “risk-based” program is exactly what the regulators are looking for and will test it to ensure you are following your own program. How often you look at these accounts (after your initial review) will also be risked-based (based on the amount of risk your institution is willing to accept) and could range from every 60 days to 12 months. Remember, once you file a SAR on an account you will be responsible to follow-up on that account (e.g. every 90 days) to verify if the suspicious activity has continued and file an additional SAR if necessary.

1) Are we required to review all of our existing accounts for high-risk and start to monitor their activities?

2) When opening a new account that falls under high-risk guidelines, what addtional information do you require at time of opening?

1. Not required by regulation, but highly encouraged by the regulators. It is really to your advantage, otherwise they will expect you to expend the same amount of suspicious activity monitoring energy on all your accounts.

2. You may ask additional questions regarding source of and expected amounts of cash flows, if they have peak seasons, etc. to give you an idea of what activity might be considered "normal".

In our AML policy we outline specific "suspicious activity" scenarios. We use our AML system to review cash transactions once a month, to identify customers whose activity parallels the scenarios. The customers are then classified as (1) well-known/low risk, or (2) possible suspicious activity/additional monitoring required. OCC was just here, and they approved this strategy.

I think many of us are confused about what we are supposed to do about high risk customers.

I have been resisting this need to identify high risk customers just for the sake of identifying them. I say this because we have AML software that will bring unusual cash or wire activity to our attention. So my question is "Why do we need to go through the exercise of identifying all these supposedly high risk businesses if we already have AML software?" If we aren't looking for unusual cash/wire activity - then WHAT ELSE are we supposed to be looking for?

The regulators giving you an MOU is a great motivater for monitoring high risk accounts and having all your accounts showing an SIC code or some method identifying type of business or type of employment. The regulators will look for every means you have in place to monitor risk and suspicious activity. We are working overtime to put a SIC code on every account and a method to isolate certain businesses to monitor.

No one has really answered the original posters question. This is because we don't know the answer! Identifying high risk customers is part one. Part two is reviewing account activity to determine if the transactions appear to be consistent with the nature of the business or person's occupation/lifestyle. Every customer will be different.

Monitoring high risk customers is going to be a royal pain for all of us. I'm sure we will all be doing it differently.

It will be very important to make sure your front line and operations people are involved. They should be responsible for reporting unusual activity - whether it includes cash or other types of transactions. Employees should constantly ask themselves if the transaction they are handling makes sense for the customer.

The only ones that can answer this question are the individual banks themselves. Regulators have given us room to maneuver when it comes to monitoring “high risk” accounts. Regulators are going to be looking that you have adequate procedures outlining your high-risk program; the program is ‘risk-based’ according to your institutions size and location; and then testing the program (to ensure you doing what you say you are doing). The key in this whole puzzle is that Banks are allowed to develop their own program based on the amount of risk they are willing to accept. If a bank cannot demonstrate that they have properly evaluated their risk levels, regulators will quickly step in.

Theoretically, a $500 million bank in the Midwest will have less risk than a $15 billion bank in New York and will need to design a customized program that fits their business. Various factors can be taken into consideration such as – customer base (e.g. US citizens vs. non-resident aliens), product types (e.g. CDs vs. On-line checking accounts), and customer location (e.g. Kiel, Wisconsin vs. Miami. Florida). Once a bank has assessed these various topics and identifies what is considered risky for them, they can begin reviewing these accounts for unusual activity. Like Dolly said – does this transaction or series of transactions make sense for this particular customer?

I agree with the above posters. If a money launderer is opening an account at your bank and you ask them what the normal amount of cash activity they will bring in, by golly, they are going to tell you the truth! How do we know what the right amount of cash deposits are for a business. Has any one out there yet figured out why gas stations bring in so much cash? I am not talking about lottery sales either. It is very difficult to figure out. Are they bringing in cash amount between $6000 and $10,000 and we hardly ever file a CTR on them? Yeah, that is a high risk customer and a suspected money launderer.

We are just starting our risk assessment, and with the recent flurry of activity regarding this issue, I'm bumping this post back up. I'm just curious to see how other banks are handling the risk assessment. My biggest question is: Once I have identified them, what am I supposed to be looking for? I'm thinking that after I have identified the high riskers, I need to set some kind of base line for what would be normal. Now, does NORMAL mean for this particular customer, for this particular product, for this particular part of the country, and for this particular type of customer? ...sigh...

You need to first be comfortable that what they are doing makes sense for their type of business, or income level/type of job for individuals. Then, you watch for changes in patterns: sudden increases in cash deposits or withdrawals, wires (especially international wires), increases in debits and credits (velocity, as in kiting), early loan payoffs, cash loan payoffs or large cash loan payments. You are looking for unusual activity you didn't expect or changes in activity.

"" over 50,000"" The question is, how many accounts does my bank have?

Thanks for the input! I guess where I'm getting at, is after I go and identify the high riskers, I can easily count on at least 1000 accounts. We are a 3 man shop for Internal Audit, and currently we have 1.5 devoted entirely to BSA (CTR monitoring). Once I add 1000 accounts that need to be "monitored", how do I squeeze that into the mix? How often do I monitor? Daily, weekly, monthly, quarterly?

This is where it becomes obvious you need an AML system. And even then you need staff to review the reports! We use a system that allows us to code customers as high risk and also looks at activity of all customers, flagging those who trip preset triggers for changes in activity (increase in cash, wires, etc.) It is very labor intensive even with a system.

Then, I would like to quote Devil Girl... "I think I need a drink!"

What amount of cash withdrawal should be considered suspicious if a customer typically makes 1 to 3 wires of over a million every three months but no large cash withdrawals? Is 750000$ normal?

Anon,
You've added your post to a thread that's about 6 months old and on a different subject. It's not going to get many views and they may not be the right people. I suggest you start a new thread of your own which is well titled and add some details such as what business the customer is in, are the wires foreign or domestic, is there anything other than the amount you regard as suspicious, etc.