It was my understanding that the new BSA/AML Exam Procedures (issued by the FFIEC) was the BSA guidance for all banks. All banks, no matter who the regulatory agency, now have the "same sheet of music".

If this is true, why is the OCC indicating that OCC regulated banks need to complete a different risk assessment? Here's a quote from a recent ABA E-newsletter:

OCC Shares BSA Risk Summary Form
John Wagner, OCC Director of BSA/AML Compliance, discussed during the ABA/ABA Money Laundering Conference how both bankers and examiners can find utility in an OCC risk assessment tool being distributed to national banks as part of the OCC's exam process. The Summary form provides a quantitative gauge to get institutions (or their examiners) started on analyzing their BSA risk exposure across products, geographies, services and customers. John was careful to point out that a bank's final risk profile is not driven by the numbers alone—rather you need to drill down to appreciate differing risk gradations within customer or transaction groupings (like MSBs) and also gauge the complexity of institution operations behind the numbers.

For a copy of the form, see: http://www.aba.com/NR/rdonlyres/C029EFA2-D64A-419E-BC3C-6B3D69728977/41020/BSARiskSummaryform.pdf
----------------------------------------------------------------------------------------------------------------------

Several of our OCC regulated clients have contacted us and told us even though the bank had completed a risk assessment from Appendix J of the new BSA Exam Manual, the OCC examiners are requiring them to complete this risk assessment. It is very time consuming.

Any comments?

I think that someone need to bring this up with the upper echelon of the OCC. I agree with you that it flies in the face of developing and having standardized examination procedures. If they want to take the time to complete it, it is one thing. But to force their banks to complete it - well that's a whole nuther animal.

Parallel thread. John Wagner is the Director of BSA/AML Compliance for the OCC and is, thus, pretty near the top of the OCC food chain on this topic. He did not say completion of the worksheets was required either of the times I heard him discuss them. He specifically said they were examples which banks were welcome to use. Obviously, a different interpretation is being offered in the field...

If completion is required for national banks, then then the "interagency" adjective regarding the examination procedures is sort of out the window.

P.S. One post that was originally in the other thread, but was later deleted by the poster, indicated that individual was told by the OCC that the worksheets were being used as some sort of an information gathering device for a national data base. I don't doubt that is what he or she was told. However, because such a compilation would be nothing less than a fruit salad of information gathered on different dates, I don't think that explanation is credible.

Shortly after our OCC exam we received a letter from the OCC regarding Money Laundering Risk (MLR) system. The system has been developed to enhance the OCC's ability to quantify BSA / AML risk within and across the Community Bank population. The system will assist the OCC to implement risk-based supervision by helping them identify their banks with high, moderate and low BSA/AML Risk.
The letter indicates I will be contacted over the next week to complete a survey regarding our banks risks. (This risk survey will then be complete annually.) After completing the survey the bank will receive an Excel spreadsheet that can be used to furthur manage the data and will be able to assit us in the development of our own BSA/AML risk assessment.
At the time of our exam we had completed our Risk Assessment following appendix J.
I Will be interested in seeing how difficult the survey will be to complete and what informaiton we receive from it.

Ken: Thanks for the link to the other string. Sorry I didn't see it before starting this new string. As you can see from several people in that other string, the OCC is requiring their risk assessment to be completed. I can verify that with discussions with 4 OCC regulated clients in the last month. Yesterday I met with a local OCC examiner concerning 2 clients of ours. The examiner verified that they are requiring it in ALL of their banks, even if the bank has completed a risk assessment in accordance with Appendix J of the Exam Manual.

Interestingly, Q&A #4 from the new FAQ specifically states:
Does the FFIEC BSA/AML Examination Manual supercede/replace all other previously issued BSA/AML handbooks?

Yes. One of the goals in developing the Manual was to ensure the consistent application of the BSA and OFAC examination guidance and procedures. The five federal banking agencies agreed that they will use these new FFIEC examination procedures.
-----------------------------------------------------------

Apparently, the OCC doesn't have to comply with these directives.

This sounds like the letter that DebK is describing:

Money Laundering Risk System
The OCC will be implementing a Money Laundering Risk System (MLR), an automated process to quantify BSA/AML (Bank Secrecy Act/Anti-Money Laundering) risk for each community bank’s products and services, customers and related geographies. The MLR will assess these risks using information you provide about your bank’s related activities. In the near future, we will be contacting you with specific information, guidance, and timeframe requirements for providing various data. We plan to obtain bank specific data between December 1, 2005 and February 1, 2006. The information provided by community banks will assist us as we implement risk-based supervision by helping to identify banks with high, moderate or low BSA/AML risk. The system is also expected to assist you in your efforts to identify, measure, monitor and control your bank’s BSA/AML risk.

This initiative may not be directly connected to the forms national banks are being asked to complete in anticipation of on-site examinations right now. On the other hand, they may be obtaining the information to establish baselines for this effort, not necessarily for use in the examination at hand.

From a November 14 letter from the Comptroller of Currency to the Chairman of the House Banking Committee.

To reinforce these actions to strengthen the OCC’s BSA/AML examination processes, I have further directed that:
[abridged]
• We use the emergency processing procedures in 5 CFR 1320.13 to obtain OMB approval for our “Bank Secrecy Act/Anti-Money Laundering Risk Assessment” information collection in order to accelerate the implementation of the OCC’s new BSA/AML risk assessment system. This system will enhance the ability of examiners at the smaller institutions we supervise to identify potentially high-risk institutions based on a bank’s products, services, customers, and locations. The OCC received OMB approval for this data collection on August 25, 2005, and I have directed that this system be implemented as part of the examination scoping activities as quickly as possible.

Seems like something that's been planned for a while, doesn't it?

All I can say is that sometimes (but not all the time) I'm happy we don't have a national bank charter.

While at the Iowa Bankers Association's Compliance Conference this week, I had a talk with Richard Riese (the new “John Byrne”) at the ABA – technically he’s the “Director of the Center for Regulatory Compliance, Government Relations/ Regulatory & Trust Affairs” (that’s a quote from his business card!). I asked him what he knew about the OCC’s risk assessment. He said that when it first came out, he was also surprised that the OCC was already deviating from the new exam manual. He contacted the OCC and was told that this was only to be used if a bank did not have a risk assessment (which still doesn’t make sense. Why wouldn’t they just use Appendix J in that case?).

I told him that this wasn’t true and that I have 4 clients that have had to complete it even though they have completed a self assessment. He was surprised and upset by this. He asked me for specific bank names. I am in the process of contacting these banks to see if I can forward their names to him.

If you are OCC regulated and have been told that you must complete the OCC's risk assessment, please let Richard know. His email is rriese@aba.com. His phone number is 202-663-5051. Richard said that he would like to have specific bank names so that they can identify the regional or field offices that are stating this. If he just tells the OCC "I heard about a bank . . ." it doesn't go very far. The ABA is lobbying for us, so please use this resource.

Left hand? Say hello to the Right hand. You're supposed to be working together......

Does anyone know what Bill Fox's reaction to this is?

Quote:

---

If you are OCC regulated and have been told that you must complete the OCC's risk assessment, please let Richard know. His email is [Email]rriese@aba.com.[/Email] His phone number is 202-663-5051.

---

Please do this. This isn't an attempt to protest the treatment of individual institutions. If he can establish that the instances are not isolated as he has apparently been told, he can get past that issue and try to determine if or why national banks are being treated differently.

Quote:

---

Does anyone know what Bill Fox's reaction to this is?

---

Every year at the Kentucky State Fair one of the most popular exhibits is a demonstration where a border collie herds ducks through a series of obstacles. Have you ever tried to herd ducks? It's real hard.

I noticed an article in the November 15 issue of American Banker (front page) that the OCC started doing this on a test basis last August. The article also indicates that "...all 2000 of the national banks the OCC monitors will, for the first time this year, fill out a "BSA/AML Risk Assessment" form detailing key inforamtion about their customer base and the loans on their books. Banks must complete the form annually."

This situation was brought up during the October Interagnecy BSA/AML meeting in Richmond. Everyone on the panel including Bill Langford (associate director of FinCEN) agreed that the Exam manual was the final say. Unfortunately there was not an OCC representative there to give their position. I can't remember who on the panel said it, but basically said that the OCC survey was to collect bank info. and should not be enforced by regulators.

Ok, we are OCC regulated and we just got a letter infoming us that we will be contacted soon to complete a survey. The last paragraph reads;

"We are excited about this new system, believing that it will also assist you in your efforts to identify, measure, monitor, and comtrol your BSA/AML risk. The data collected by your bank will be useful in the development of your own BSA/AML risk assessment that is discussed in the June 30, 2005 FFIEC Bank Secrecy Act/Money Laundering Examination Manual. In addition to the raw data you will have as a result of this effort, we will provide you with an Excel spreadsheet that can be used to further manage this data."

So, it sounds to me as if this is meant to be a tool, not a replacement to Appendix J.

If the risk matrix in discussion can truly provide a concise, rational analysis of our products and services why hasn't it been provided to each bank by its regulator and been made the industry standard? As I recall, we have been begging for guidance in the risk assessment process to insure consistency in results and application to our BSA programs. I would be thrilled to utilize a tested, regulator-friendly format and remove the guesswork out of the process. The regulators should get together, determine the value of this automated process and put it out there for everyone. (Would that be too easy? Am I over-simplifying?)

Just don't ask me to invent a wheel, decline to tell me how to do it, and then tell me "never mind we want you to do it this way" AFTER I've completed the task. Where's a good duck shepherd when you need one?

Sorry, I guess this post should have been prefaced by a "rant warning". Maybe I had one piece of pie too many this week (or maybe I need another!)

Bravo BrendaC! I totally agree.

We are a national bank and I just recieved my "Bank Guidance" from the OCC for the Money Laundering Risk System.

(Heavy sigh) I will just add it to the rest of the "data entry clerk" jobs I have been given since taking this position a year ago.

Who else is drowning in a vicious cycle of spreadsheets? Hands? Anyone? Anyone?

But, I am sure that this Money Laundering Risk System will make things alllllll better.

Hand up! Thanks for posting this Dave. I was wondering what this was when it crossed my desk.

We are an OCC bank, and I think completing the information requested will make our lives easier in the long run. We've done a comprehensive risk assessment ($500 million midwest bank). I feel the OCC is just standardizing how they want to see the information. Yes, this will be regurgiating the info in another way. However, it should shorten examiner time in the bank, and the number of questions they may have - so we should be glad to accomodate that! Being in the Midwest, I believe this will be to our advantage as we're a BSA lower risk than some other areas of the country, and this standardization may allow us to drop off the regulators BSA radar screen.

MLR thread

We got ours yesterday as well. Just an FYI - this isn't new. We filled out the same thing last January for a February exam.

When it was explained to me, it was in the context of helping the OCC maintain a database of information about the state of national banks' BSA risk. I got the impression it was more for the agency's use than it was for examiner's use in planning exams.

I think the comments about this being a risk assessment are more of an attempt to make the exercise have some tangible benefits to the bank - make it a little easier to take on one more thing to do.

Kaybee noted in the thread linked above that she had received the form in connection with a 2004 exam. Apparently, they passed out several of them before they decided to formalize it.