Yesterday I saw the Joint Agency Release for the "control list" that the FBI and other have put together, but the only agencies listed were the Fed, OCC and NCUA - what about the OTS and the FDIC??

Has anyone heard whether those 2 agencies are getting on board - there is nothing on either of their websites.

Thanks

We wondered the same thing, since the document we were privvy to also did not reflect FDIC or OTS. OTS has since issued a CEO Letter, however, and we're certain FDIC will also be part of this joint effort.

Since the regulatory agencies will be sending a direct communication to the institutions under their jurisdiction, state-chartered nonmember banks will know for sure when they receive a communication from the FDIC.

For those not familiar with this Control List and the issues involved -- and the October 12 deadline, click here.

As a matter of reference, I rec'd my request from Fed (Atlanta) on Oct. 5 and it was joint with FDIC, OCC, OTS, and NCUA. Perhaps it depends on your fed district.

We have responded, but does anyone know if everyone will receive the control list or just selected institutions? Also, should we expect to get the list when we respond or sometime after Oct. 12 when everyone has responded?

Thanks,

------------------
Opinions expressed are not necessarily those of my employer.

[This message has been edited by CAnderson (edited 10-10-2001).]

I thought this was interesting, not only did I get a joint notice asking for contact person, I also got a notice from my regulator (OCC) wanting to know the same information. Both requests had different e-mail addresses to send the required information to. I have a feeling I am going to be getting two e-mailed control lists.

P.S. My letter from the FFIEC has all 5 agencies on it.

[This message has been edited by Jennifer (edited 10-10-2001).]

[This message has been edited by Jennifer (edited 10-10-2001).]

[This message has been edited by Jennifer (edited 10-10-2001).]

Did I understand that the control list will be confidentialinformation not on the OFAC list? I am having a very dificult time just keeping up with the OFAC verifications right now.

Yes, the control list is different from the OFAC list. Plus, the OFAC list is public, and the names on the control list are highly confidential and can only be disseminated within your institution on a need-to-know basis.

Can someone tell me how they are going to run the "Control List" against your data base. We outsource our host and have no software for OFAC runs. We use Thompson Financial to do an semi-annual OFAC run on our data base, but as you have indicated we can not give this information out. Help!

We have no idea how long the list will be. If you do alpha searches manually on your database that may work. If it has to be incorporated into a vendor's workload, A) I'm not sure how they'll add a subcategory to the OFAC program but it may be doable, and B) with regulatory approval some sort of confidentiality agreement may be written and permissable.

------------------
Andy Zavoina
Opinions stated are not necessarily that of my employer.

This plan is obviously a little premature since I haven't seen the list yet, but we will create a special search report using our report writing software. To aid in identifying a suspect using an alias, I hope to be able to search for other data in addition to just a name search (such as DOBs and SSNs). We have banks in areas frequented by previously suspected terrorists, so I want to search as thoroughly as possible.

Does anyone know how the agencies will contact the banks to obtain the name of a designated person, is there a form to complete authorizing that person to receive this information, will they contact us by phone?

I was contacted a few days ago by email and asked to provide a name, title, email address, phone number, etc.

The OCC Alert asked for us to e-mail specific information to them designating the point of contact and contact information.

------------------
Andy Zavoina
Opinions stated are not necessarily that of my employer.

OCC's directive also indicated we should provide info to our bank's examiner in charge. When I called our local OCC office to get an e-mail address, they indicated they had received instructions to telephone each OCC bank within their region.

You know I was wondering......... How is this going to be so "confidential" if it is to be sent to us by email? We all know email is not secure. Couldn't just anyone get their hands on the "confidential" list if they really want?

Just a thought in my near delirious state of mind.

I'm glad bwest already brought this up. I've been wondering if the examiners are checking the addresses they get. For example, if one of the bad guys does a little surfing, he will find a regulators site, see the request for email addresses and then send in his own email address pretending to be the contact for a real bank. (It's not rocket science.)

Does anyone know if the regulators are only allowing one email for each institution or will they send to multiple addresses for the same bank? Hopefully, only one email per bank and let the bank redistribute within our own networks when and if necessary.

PS In regard to notifying our own examiner-in-charge, we simply used snail mail.

------------------
Opinions expressed are not necessarily those of my employer.

1) They should easily be able to select correct bank addresses. I've been e-mailing my regulators for years, they look at our Web sites, and they can do a telephonic verification if they need, so validation shouldn't be an issue with any amount of due diligence. If my address was xyz@yahoo.com, I'd expect some questions.

2) Perhaps like Internet banking, they'll make the list available for download from a secured site and we'll have passwords. The OCC has such an animal now where we get peer information. Otherwise, we are looking at encryption, systems, etc. and I don't think anyone wants to go there.

I did find it interesting that e-mail seems to be the preferred medium for communication. That doesn't mean the list will come to us that way, but it is fast, accurate and readily available. They have accepted that. Next we have to deal ith infrastructure. What happens when that central point of contact leaves or goes on vacation? A backup is needed.

And posting the Alert on their What's New page also was fast. I still have not seen that hard copy. Had the Control List not been mentioned here, I'd have been behind the power curve on this one since I hadn't gone into the OCC's site this week.

------------------
Andy Zavoina
Opinions stated are not necessarily that of my employer.

I subscribe to several daily regulatory update services, including one the OCC offers, and I found it interesting that none of them had information about this control list until yesterday, even though the information was apparently available last Friday. We got the call from our examiner in charge asking for our contact information on Tuesday before we had even heard about this. I wonder why this was delayed.

Have any state, nonmember banks heard directly from the FDIC yet? The cover letter from the OCC is asking for a contact person by Oct 12.

I just spoke to the General Counsel of our State Banking Department and learned the reason state-chartered banks have not heard from the FDIC directly is because the FDIC already maintains records of email addresses of senior level officials and they plan to use the list they already have to communicate regarding the control list.

That means that institutions with FDIC as their primary federal regulator will not need to make a separate designation to FDIC by 10/12.