Learn about types of risky businesses, the BSA/AML concerns and how they may or may not be a market niche for your institution.

Transcription

1 Learn about types of risky businesses, the BSA/AML concerns and how they may or may not be a market niche for your institution. August 2014

2 A Table of Contents Money Services Businesses pg. 3-7 Third Party Payment Processors pg Marijuana Related Businesses pg

3 Most of us are familiar with the requirements of servicing Money Services Businesses, (MSBs) and may have even made a policy decision on whether or not your institution will service these businesses. A money services business is a subset of non-bank financial institutions. They provide banking services even though they are a non-bank. The definition requires MSBs to conduct at least $1,000 in total transactions to one customer in one business day. They also must be registered with FinCEN while other NBFIs don t have this requirement. Not all MSBs are created equal and not all of them have the exact same risk. For example, a mom-and-pop store that cashes an occasional check brings a vastly different risk threat when compared to a pay day lender. The FFIEC Exam Manual includes MSBs as higher risk. Dig into the manual where it outlines exactly what they believe are the risk factors and what you can do to ics. mitigate them. This is the first step for understanding the total risk. 3

4 We need to be looking for the risk factors that accompany servicing MSBs. One of the biggest risks is that MSBs don t have ongoing customer relationships, generally utilizing one-time transactions. Customers only cash one check and often have to produce limited or no identification. MSBs also engage in frequent cash transactions where the source is unknown. MSBs also may quickly change the products that they offer, the ownership of the business or even locations of the business. They can frequently move, which dramatically changes their geographic risk and you might not be aware when they moved. Additionally, there are some that will operate without registering their business, so you always need to check that your MSBs are registered with FinCEN. That doesn t mean you can t successfully bank MSBs. Currently Banker s Toolbox has a customer handling more than 100 MSB customers with minimal regulatory issues. It is a very lucrative business, and can be very profitable when you staff appropriately, do your due diligence and price accordingly. 4

5 There are some mitigating factors you will want to employ if you decide to service MSBs. First, obtain the proper documentation. Make sure they are registered with FinCEN and with any requiring state organizations. Acquire a copy of all registration documentation. All MSBs are required to have their own AML policy, so acquire a copy for your files as well. Confirm their agent status. If they are not an MSB; but an agent of a Western Union or another company, you will need to know. You can go to Western Union s website and see the list of all of their agents. Get a copy or a picture of that list for your file if applicable. Also, conduct ongoing due diligence and suspicious activity monitoring, more than your regular reports. You should do enhanced due diligence on a quarterly basis for your higher risk MSBs.. You may decide as an institution to bank MSBs, but only the less risky MSBs. If so, make sure your policy reflects that. Regardless, if you decide to service both low and high risk MSBs, you should implement risk scoring at your institution. Reflect the results of your risk scoring in your risk assessment to identify and list different levels of MSBs. 5

6 If you choose MSBs as your market niche, make sure you follow your policy and mitigation techniques. This means truly knowing your customers. Site visits are imperative, and your overall relationship is very important. When you do your risk assessment, give MSBs their own section because they are high risk and regulators like to focus on them. Include how many MSBs you currently service, what level of risk they are, what your mitigatiion techniques are for each level and the residual risk of servicing those MSBs. A separate section shows you understand the importance of that risk and how you are addressing it. Then charge appropiate to the risk and work you are incurring. You can generate a lot of income through this market niche provided you price accordingly. How much should you charge? If the MSB has a high volume of transactions you should have a higher fee income because analysis is more extensive. Additional flat fees to cover all soft dollar monitoring costs, anywhere from $250 for low risk to $1000 for higher risk per month. It s not avarice to charge these prices, simply wise to be compensated for your work. 6

7 Automated systems allow you to quickly do the tasks needed to monitor your MSB accounts. Even if you don t have automation in place, there are cash reports you can pull from your core and other ways to identify MSBs. You need a unique identifier to track exactly who your MSBs are and how many you have. Regulators want to know if you are servicing MSBs and, if so, they will want a list of them. Once identified, you will be able to report and monitor them, as well as assign appropriate risk points for your risk scoring. Grouping your MSBs will also allow you to perform peer analysis, which regulators want to see. Peer analysis is a great way to identify suspicious outliers. Group your MSBs with similar business profiles to determine if one is falling outside the normal range of cash activity. That is the MSB you need to drill down on and find out why they have so much more cash on hand than their peers. Also, document your findings on the customer TIN or account to show enhanced due diligence. State you have looked at the entire relationship, what your findings were and your due diligence. Your need to state this, even if nothing turned out to be suspicious, you need to explain why it is normal. However, if something can t be explained it might be time to file a SAR. Risk rate your customers at account opening, especially your higher risk customers. In addition, the exam manual does expect us, at account opening, to ask questions about expected activity. With an automated system you will be able to monitor expected activity with actual transaction activity within 90 days. Compare what is different from what they told you they were planning on doing. Cash scenarios and reports will help you identify your MSBs that you haven t identified before. 7

8 Third Party Payment Processors (TPPPs) are a hot topic for examiners so it s important that if you service them that you pay close attention to their activity. Let s start with the basics and define a TPPP. We aren t talking about the small ACH originators that maybe process a payroll or process gym memberships, these are the big organizations running a lot of processing payments through your institution. These are bank customers that have an account with you and provide the payment processing services to merchants or other business entities. The TPPP s customers generally do not have an account with you, so you don t know their customer. As a result, CIP and due diligence become difficult if not impossible. These payments are going through your bank and you don t know the source of funds, or even if they are coming from an international source. Historically, TPPPs were brick and mortar establishments, primarily handling credit card payments but also ACH and Remotely Created Checks (RCCs). Now all bets and borders are off with the expansion of the internet. There is true worldwide risk with unknown challenges and variable factors. TPPPs are not subject to any regulatory requirements at this time. Because of the lack of regulation, TPPPs are open to money laundering, identity theft, fraud, illicit sources, (example sources: internet gambling, prostitution, child pornography) or OFAC sanctioned transactions. In 2012, FinCEN recognized this was an issue for financial institutions and issued some red flags. If you see your customer receiving a high number of consumer complaints and chargebacks, they probably don t have good policies or procedures in place. To check online complaints look at websites like Federal Trade Commission, Better Business Bureau and the State Attorneys General. If a company has a lot of complaints they might not be good to do business with. If your customer has accounts at multiple financial institutions find the reason behind it. This could be suspicious. 8

9 Masked illegal activity by tripping ACH credit activity information is another red flag. If your IATs are coming in and sometimes they can trip foreign address, it s illegal, so you need to watch out for that and make sure IATs are coming in properly. If your customers are processing telemarketers and online businesses, especially if they are foreign, that would be something to investigate. If you are a distressed financial institution some customers may take advantage of your need for their business and hope you won t ask all the necessary questions. If that is happening at your institution, look into it, and maybe take that as a red flag. If the debit transaction rate of return is higher than average, it is a red flag. This is where a peer analysis will be able to help you. If these customers are able to charge their customers exorbitant fees for processing, that s a good sign that something is suspicious. They will pay anything to get their, probably illicit, transactions processed. Check the income rate of return of your customers compared to that of their peers. You can successful bank TPPPs if you are willing to mitigate their risks. Update your AML program to identify and mitigate the risks. That includes the same thing we talked about with MSBs. Have a separate section in your risk assessment detailing how you deal with TPPPs. Include how many you service, the risks and how you are mitigating them. Next, authenticate your TPPPs by implementing background checks. Find out what you can about their customers on a risk based approach. Remember, just like MSBs, not all TPPPs are equal. Obtain their customer list and corporate documents and use them to search for negative news and background information. 9

10 Site visits are very important for any of your high risk customers, TPPPs are not excluded. This may even just be internet based depending on the situation and that will need to be a documented risk based decision. Periodically, you will need to re-verify all your documentation and do those internet searches. For the beneficial owners, if you really know who they are, find out what other businesses they re in and the customers they are processing for, and what type of businesses are their customers in? Investigate the item returns and see if they have good policies and procedures in place for fraud, if they don t, that is a starting point for a problem. Then, per FinCEN guidance, if you do have to file a SAR on a TPPP include the term Payment Processor in both the narrative section and the subject occupation field of the SAR. Monitoring TPPPs is a very similar process to monitoring MSBs. Flag them to make sure you can identify these accounts, pull reports, do peer monitoring and assign greater risk points. Document your due diligence and make sure everyone knows you are watching these accounts and you are doing it more frequently than your lower risk accounts. Then monitor your expected activity with actual transaction activity and check your ACH scenarios and reports to see if there are any outliers with volume. Especially look at your IATs and make sure you have a good sense of any ACHs coming in

11 One of the hot topics right now revolves around the debate of servicing marijuana related businesses. Even if your state hasn t legalized any use of marijuana yet and it doesn t appear on the horizon, you should be paying attention to this developing business line because it will likely still affect you one way or another. For starters, marijuana businesses are probably already affecting you indirectly. There are many scenarios to think about. For example, let s say you have a customer in Texas, a state that hasn t legalized marijuana yet, who wants to invest in a dispensary business in Colorado, which has legalized the recreational use of marijuana. The Texas company sends a $50,000 investment to that company via wire and then starts getting their royalties from their income which gets deposited into the Texas financial institution. By federal law, that income is derived from illegal activity and now it s in your bank. So it does apply to everyone in this country that is in a federal institution, or even a state institution that is federally regulated, even if your particular state doesn t allow recreational or medicinal marijuana. 11

12 Under the Controlled Substances Act (CSA) it is illegal to manufacture, distribute or dispense marijuana. CSA is a federal law and federal law supersedes state law. In addition, all financial institutions in this country are federally regulated, so is servicing these businesses even an option? Currently there are 22 states and the District of Columbia that have legalized some marijuana related activities. There are also a few states that have active legislation pending on the legalization of certain marijuana related activity that may or may not pass. Legal acceptance is definitely spreading. Colorado and Washington state are the only two states to legalize the recreational distribution and use of marijuana and marijuana related products. Part of the Colorado state law requires each business involved in the distribution of marijuana to clearly signify itself as a marijuana related business. If you are going and bank marijuana businesses look at the name to determine if they are trying to be out in the open about what they are selling, that is going to be very important. 12

13 Because of the contradictory legislation and the ongoing controversy surrounding the official Cole Memo, FinCEN issued some guidance to financial institutions in February This was a response to financial institutions that didn t want any part of the activity surrounding this risky industry, but found they already had businesses in their institution taking part in the industry. The Cole Memo was something that the US Attorney Generals wrote to themselves in It is a DOJ memo that reiterates Congress s determination that marijuana is a serious crime and it provides significant income to criminals, gangs and cartels. It further advises US prosecutors to focus on preventing the distribution of marijuana to minors and revenue from going to criminal activity. In addition, it points out that the diversion of marijuana to states where it is legal could be used as a cover for distributing other illegal drugs, violence and firearms within business. It also warns against drugged driving, adverse public health, the growing of marijuana on public lands and the possession or use on federal property. 13

14 This memo doesn t really ask Federal Prosecutors not to prosecute state legalized businesses (or financial institutions doing business with them), but it doesn t give financial institutions the safe feeling they re looking for. So should you service marijuana related businesses? FinCEN states the decision to open, close or refuse these businesses should be individually made by each financial institution, based on its ability to mitigate associated risks. If your institution is in a high-risk jurisdiction, maybe you don t want to take that on. Some of you have already made the policy decision to not service these businesses. Others are currently servicing them, some without even knowing. Establish your financial institution s business objectives. If you are more conservative in your approach, you might not necessarily want to get into this industry. Also, what is your risk tolerance for regulatory scrutiny? You may know your regulators well enough to determine it is not worth the risk. If you are struggling with MSBs, you probably don t want to enter this market quite yet. Determine if it is cost effective to provide the resources needed to ensure risks are mitigated. It is going to be more work than the MSBs because this is a cash intensive operation. It is drug money, and it may be legal in your state, but you don t always know where the money is coming from. 14

15 Due diligence is critical. You have to go overboard if you choose to accommodate these businesses, which you can do successfully if you are committed to the work that goes into managing the risk. The financial institutions that have mixed feelings about servicing these businesses, especially in the smaller communities, worry about all the cash sitting in their vaults or in the actual stores because they can t be banked. We know from law enforcement these stores are susceptible to robberies because of all of the cash onsite. If you want to bank these businesses make sure you verify and review all state licenses and registrations involved. If you have branches in various states, each state is going to be different so pay attention and make sure you have the proper paperwork. Periodically update this review to make sure licenses have not been revoked and do ongoing EDDs. Make site visits as well, so you know exactly what products they are selling. Determine if it is a medicinal or recreational store and get to know owners to understand their expected activity and customer base. This type of store is a different universe for bankers, but site visits could provide beneficial observations. Monitor ongoing public information to see if there is any negative news circulating when you search your businesses and related parties. Do you know the beneficial owners listed on that state registration? Do negative news searches on them as well. Find out what they do for a living and what they are involved with. If they re foreign you need to really look hard. Constantly do ongoing suspicious activity monitoring, on top of the monthly monitoring reports and enhance due diligence at least quarterly. Then file a SAR if necessary, considering all the aspects of the Cole Memo. 15

16 Speaking of SARs, here is a quote from the guidance addressing the obligation to file a SAR on marijuana transactions due to the fact the sale of marijuana is against federal law: Because federal law prohibits the distribution and sale of marijuana, financial transactions involving a marijuana-related business would generally involve funds derived from illegal activity. Therefore, a financial institution is required to file a SAR on activity involving a marijuana-related business Even in states where marijuana is legal you have to file a SAR on every single transaction. Whether we like it or not, it makes sense under the current law. This will include 90 day renewals for continuing activity. The guidance goes on to say what types of SARs should be filed, there are 3 different kinds: 1. The Marijuana Limited SAR Filing is to be filed if there is reasonable belief that no Cole Memo violations have occurred. It s a legitimate state registered marijuana-related business and you see nothing suspicious going on. The content in your narrative should identify information on the subject and related parties. Include the addresses of the subject and related parties, so any owner needs to be a subject. You need to state the fact that the SAR is being filed solely because the subject is engaged in a marijuana related business and use the term in the narrative Marijuana Limited. That is telling the federal government that this is a marijuana related business but it is not doing anything wrong. This will include 90 day renewals for continuing activity. BAM+, one automated suspicious activity detection system, allows you create a template so you can have the same paragraph every time. Functionality like this makes this process a little less burdensome. 16

17 2. When you get into Marijuana Priority we are getting more serious. This is where you do have reason to believe that something illegal is occurring. The same SAR rules apply as any other suspicious activity. Tell the whole story of who, what, when, where and why you think it is suspicious. Be sure to put Marijuana Priority in the narrative section. This indicates you believe something illegal is going on in a legalized state. 3. The last type of SAR that could be filed is Marijuana Termination. This means that if a financial institution decides to terminate a relationship with a marijuana related business in order to maintain an effective AML program (risk and cost) the institution should do the following: File a SAR including a note in the narrative for the reason why the termination is occurring, it could be that monitoring is too costly and the risk too great. Nothing really illegal has been found necessarily. Use the term Marijuana Termination in the narrative. If you did find something illegal and you terminated the account, and you re sharing, then you may want to go ahead and use the 314(b), per FinCEN s advice. 17

18 Let s examine red flags for the Priority SARs: If the marijuana dispensary has substantially more revenue than is reasonably expected given state law limitations, that should be a red flag. Although it can differ, most states have limits of how much can be grown and sold. If the income is over that limit you should have serious concerns. Are their cash deposits or withdrawals excessive over a short period? This is something that can be determined using peer analysis. Relative to competitors and expected activity of the business, identify if this activity is excessive. Look at the dispensary s financial statements and confirm they are consistent with their actual account activity. Look at tax returns to determine what kind of cash they are reporting compared to what you are seeing in your financial institution. Do the deposits indicate they might be structuring? High velocity of money moving in and out of your institution quickly is a red flag. Deposits by third parties with no apparent connections to the accountholder would also be a red flag. Is there excessive commingling of funds with personal accounts or seemingly unrelated business accounts? Is the owner or manager residing outside of the state where the business is licensed? o Do they have foreign ties? Is the customer attempting to hide the nature of the business with a nondescript name, such as consulting, holding, or management company. This list is not comprehensive so if you decide to service these businesses, please read the full guidance

19 Can servicing marijuana businesses be cost effective? Absolutely, if you price them in the same fashion you would for an MSB with analysis charges plus a flat maintenance fee. Automated monitoring would almost certainly be required, because you will likely get cited by your regulator on cash reports alone. BAM+ from Banker s Toolbox has several tools which can help with the monitoring of this business type. Bear in mind, this will be a significant amount of work, even if you have an automation tool. To recap on marijuana related businesses; first, decide if you want to service these business based on your institution s culture. Should you bank these businesses, do you even want to? Those are important questions to start off with when thinking about this new industry. If the determination is made to bank marijuana related businesses, it is critical to perform an extremely thorough enhanced due diligence. Document everything that has to do with the business. No less than quarterly will you need to do a relationship review. Build a strong AML program to include ongoing EDD and suspicious activity monitoring, and include the steps you will take in both of those. Put this and your mitigating factors in your risk assessment. Be sure to price for cost effectiveness to make it successful. If you are just breaking even, it is not worth your time. This is a new MSB plus the added fear of the unknown. Lastly, be on the lookout for new laws and regulations coming down from Federal and State authorities. As this trend of marijuana acceptance grows it will eventually get to the point where more definite laws are on the books, so be ready when that happens. 19

20 These businesses are called risky for a reason. If you decided to service these businesses bear in mind that you are opening yourself to extra monitoring risk. If you prepare accordingly and price to your advantage you can enjoy these market niches. Our industry leading product, BAM+, has built in SmartScenarios that can help in detecting suspicious activity associated with these risky businesses. If you don t have a system in place or your system is unable to help you with these businesses, us at Experts@bankerstoolbox.com and learn more about BAM+ today. Want to learn more? Please visit for more information on our products and how we are helping financial institutions at every asset size across the country. At Banker s Toolbox, we are working to stop fraudsters, crooks, gangsters, human traffickers, drug dealers, terrorists, elder abusers and all those who would do us harm through our industry leading fraud and AML detection solution, BAM. About Banker s Toolbox Austin, TX-based Banker's Toolbox, Inc. helps community financial institutions manage risk and streamline compliance examinations. The company's product suite consists of proven solutions for money laundering detection and reporting, risk management through fraud and kite prevention, secure wire processing automation, and commercial real estate loan portfolio risk assessment. The Banker's Toolbox team is a unique combination of seasoned bankers, former regulators, and information technology consultants who specialize in designing, developing, and implementing risk management solutions while providing unparalleled customer service. For more information, visit the company's website at 20