BANK SECRECY ACT COMPLIANCE PROGRAM AND PROCEDURES. Section I Introduction 2. Appointment of Bank Secrecy Officer and Successor(s)

Transcription

1 BANK SECRECY ACT COMPLIANCE PROGRAM AND PROCEDURES Section Sub- Topic Page Section I Introduction 2. II Appointment of Bank Secrecy Officer and Successor(s) 2 III Currency Transaction Reports 2 IV V Monetary Instrument and Cash Advance Recordkeeping Recordkeeping for Fund Transfers (Generally Wire Transfers) 3 5 VI Prohibited Conduct 6 VII Member / Customer Identification 7 VIII Member / Customer Identification // Emergency Situations 9 IX Suspicious Activity Reporting 10 X Special Measures Under the USA 13 PATRIOT Act XI Record Retention 13 XII Training 14 XIII Audit Procedures/Independent Testing 15 XIV Anti-Money Laundering Procedures 16 XV Office of Foreign Assets Control Procedure and Procedures 20 1

2 The Credit Union adopts these procedures per the directive from the Board via the Board s Bank Secrecy Policy; and in recognition of the Credit Union s obligations under the Bank Secrecy Act and regulations (31 CFR 103) and the requirements of the NCUA as established in 12 CFR 748 for compliance with that Act. Federal law provides for severe penalties for persons participating in a violation of the currency reporting requirements. II. Appointment of Bank Secrecy Act Officer Ruth A McCloud is appointed as the BSA officer. If for any reason this officer is unable or unwilling to perform the duties of BSA Officer Todd Bush is the alternate BSA Officer. If either of the named persons is unwilling or unable to serve as BSA Officer the Credit Union s CEO shall assume the duties of BSA Officer. The BSA officer is responsible for coordinating and monitoring day-to-day compliance with the BSA including the training of Credit Union employees on BSA requirements. The BSA Officer may delegate certain BSA/AML duties or activities under these procedures or related policies to other employees or agents of the Credit Union as deemed necessary of appropriate. However, the BSA Officer shall at all times remain responsible for compliance with this BSA Program and related policies. III. Currency Transaction Reports Credit Union employees involved in a reportable transaction are responsible for completing the appropriate CTR form and signing the form as preparer. The BSA officer reviews and signs the completed form. The completed report is then filed with the Internal Revenue Service (IRS) and a copy retained by the Credit Union. Currency Reporting Requirements The BSA requires that all transactions with a nonexempt person involving currency that totals more than $10,000 in one day be reported. FinCEN requires reports to be filed electronically using the BSA E-Filing System. We will file the reports no later than 15 days after the date of the transaction. A report is required not only on individual transactions of more than $10,000 in currency, but also any time our Credit Union has knowledge that there are multiple transactions by one person in any one day which total more than $10,000. The transactions subject to reporting include deposits, withdrawals, exchanges (of checks for cash, for example), or any other transfer, receipt, or delivery of currency by the Credit Union. The Credit Union must report not only the individual conducting the transaction, but also the person on whose behalf the transaction was conducted. For example, reports for currency deposits or withdrawals made for a corporation will include the name of the individual making the deposit or withdrawal as well as the name of the corporation. In addition, if a Credit Union employee involved in the transaction has reason to believe that an individual conducting a reportable transaction is doing so on behalf of another 2

3 person, the employee will inquire about the individual on whose behalf the transaction is being conducted. For example, when a real estate broker deposits more than $10,000 in cash into a broker s trust account, and the Credit Union has reason to believe that the money is being deposited on behalf of a client, the Credit Union employee should inquire as to the identity of that client and complete the CTR accordingly. Identification of Individual Conducting Transaction Before completing any currency transaction for which a CTR is required, the Credit Union will verify the identity of the individual conducting the transaction by reviewing the individual s appropriate identification. If the individual indicates that he or she is an alien, or not a resident of the United States, the transaction can be completed only if the individual presents an official document evidencing nationality or residence (passport, alien identification card, foreign driver s license with indication of home address, etc.). In all other cases, the Credit Union will verify the individual s identification by examining the individual s driver s license, or if the individual has no driver s license, the transaction will be completed only if the individual presents some other form of identification (a credit card, etc.) that the Credit Union accepts when cashing checks for non-member / non-customers. If the individual is a known customer of the Credit Union with the above identification information verified on a signature card, identification need not be verified at the time of the transaction. However, the driver s license number or other document identifying number must be obtained from the signature card and included in the CTR. Notations such as known customer or signature card on file are prohibited and cannot be given as a method of identification. IV. Monetary Instrument and Cash Advance Recordkeeping The Credit Union will retain and record certain information each time it issues or sells a Credit Union check or draft, cashier s check, money order, or traveler s check for cash in the amount of $3,000 to $10,000. This recordkeeping is also required with regard to cash advances on credit cards not issued by the Credit Union. The Credit Union is not required to retain information if no currency is involved. For example, the purchase of a cashier s check paid for with a personal check is not a covered transaction, regardless of the amount. Similarly, the Credit Union does not keep information about transactions when the proceeds of a loan are disbursed to the borrower in the form of a cashier s check, regardless of the amount. The Credit Union must retain only information about the purchaser of these instruments ( Cashiers Checks ). Information to Be Retained General Items such as Cashier s Checks: The information that must be retained by the Credit Union varies, depending on whether the purchaser of the instrument is a 3

4 depositor of the Credit Union. If the purchaser has a deposit account at the Credit Union, the following information must generally be recorded in the log: Name of purchaser Date of purchase Type of instrument Serial number of instrument Dollar amount Verify Identity: The Credit Union must verify that the individual is an account holder or must verify the individual s identity. This can be done through a signature card or other Credit Union record containing the depositor s name and address if the depositor s name and address were verified at the time the account was opened or at any time subsequently. If any person has not been subjected to the Credit Union s CIP verification process, then such must be completed before providing any services to this person. Non-Members: There are some services that may be provided to non-members. When allowed, the following general information must be obtained and most will be recorded on our Non-Member Information Card Name and address of the purchaser Social security number of the purchaser; if the purchaser is an alien and does not have a social security number, then the alien identification number Purchaser s date of birth Date of purchase Types of instruments purchased Serial numbers of each of the instruments purchased Dollar amounts of each of the instruments purchased Verification of identity consistent with the Credit Union s MIP Procedures Non-Member Transactions With the exception of the cashing of US Savings Bonds or having to process and withdraw a beneficiary IRA, the credit union will not perform any cash or other monetary instrument transactions for non-members unless the non-member is negotiating a check, as a holder in due course, against a member's account. Money Orders As a part of its Bank Secrecy Act duties, the Credit Union must also retain records for Member redemptions of money orders between $3,000 and $10,000. 4

5 Member Redemptions of Money Orders: For members purchasing or redeeming money orders or redeeming traveler s checks, the Credit Union will gather and record the following information: (1) name, (2) member account number, (3) date of the transaction(s), (4) branch where the transaction(s) is/are made, (5) type of instrument(s) redeemed or purchased, (6) serial number(s) of the instrument(s), (7) named payee(s), and (8) dollar amount of the transaction(s). Reminder: Complete a Currency Transaction Report for each applicable transaction that involves cash in or out of the Credit Union in an amount over $10,000. Multiple Purchases -- Aggregation Obligations: Like the rules for currency transaction reports, multiple transactions in one day are aggregated. Thus, multiple purchases of these instruments by a person in any combination that involves $3,000 to $10,000 in currency in one day must be aggregated and information retained. V. Recordkeeping for Fund Transfers (Generally Wire Transfers): Whenever the Credit Union accepts a payment order for a fund transfer in the amount of $3,000 as the originator s Credit Union, the Credit Union will obtain and retain either the original, a microfilm, or other copy or electronic record of the following information relating to the payment order: Name and address of the originator Amount of the payment order Execution date of the order Any payment instructions Identity of the beneficiary s or recipient s institution In addition, the Credit Union will retain as many of the following items as received with the order: Name and address of the beneficiary or recipient Account number of the beneficiary or recipient Any other specific identifier of the beneficiary or recipient For each payment order that the Credit Union accepts as the beneficiary s institution, the Credit Union will retain the original or a microfilm, other copy, or electronic record of the payment order. 5

6 If the Credit Union has reason to believe that the person receiving the proceeds is not the beneficiary, then the Credit Union will also record all of the information noted above for the beneficiary as well as for the person receiving the funds on his or her behalf. If the proceeds are delivered other than in person, as the beneficiary s institution, the Credit Union will retain a copy of the check or other instrument used to effect payment, or the information contained thereon, as well as the name and address of the person to whom it was sent. The Credit Union will keep the required information and be able to retrieve it by using an account number. Exemptions from the Recordkeeping Rules Fund transfers or transmittal orders are exempt from the recordkeeping rules if the originator and beneficiary are one of the following: Domestic bank Wholly-owned domestic subsidiary of a domestic broker or dealer in securities The United States State or local government or government agency Non-bank financial institution The Credit Union also does not need to retain the information noted earlier for transfers or transmittal orders when the originator and the beneficiary are the same, or when the originator s and beneficiaries domestic banks are the same. VI. Prohibited Conduct It is illegal for any person to structure transactions with the Credit Union to evade the reporting requirements. It is also illegal for anyone to assist another person in structuring transactions to evade the reporting requirements. Therefore, Credit Union employees will not assist any person in structuring transactions to avoid a CTR or any of the other recordkeeping/reporting requirements of the act, including fund transfers. If a Credit Union employee suspects that a person is purposely structuring transactions with the Credit Union to evade the reporting requirements of the BSA, these suspicions are to be reported to the BSA officer. If a violation of the BSA is suspected, the BSA officer should contact the IRS. In accordance with the Right to Financial Privacy Act (12 USC ), information provided to the IRS should be limited to: Names, addresses, and taxpayer identification numbers of any persons involved in the suspicious transactions 6

7 Type of account involved Interest paid on the account Location of the branch or office where the suspicious transactions occurred Specification of the offense that the Credit Union believes has occurred Description of the activities giving rise to the Credit Union s suspicions The Credit Union will make the report on the suspicious activity report (SAR) form required by FinCEN, NCUA and will send to the central location noted in the form instructions. The Credit Union will not prepare a CTR unless the suspicious activity involves a currency transaction over $10,000. VII. Member Identification Credit Union management is directed to implement a member identification program based on a risk-assessment that has been presented to and approved by the board of directors. At a minimum, Credit Union employees should obtain the following information from all new members on all new accounts by using the Member Data Sheet. If the employee believes the member is providing false information, he or she will report the incident to the BSA officer or immediate supervisor for further action on the Member Data Sheet or BSA Concern Sheet, which may include the filing of a SAR. Third parties: It is understood that the Credit Union must rely upon third parties in order to provide various products and services; and to ensure the Credit Union is profitable and sound. Therefore, the Credit Union is authorized to rely upon third parties with regard to any duties or obligations in this Procedure where management s risk assessment provides that it is prudent to do so. Required information/documentation for individual accounts: The Credit Union is required to obtain and create a record of all of the following for each customer: Name Date of birth (NA to business entities) Street address Taxpayer identification number (TIN) or Employer Identification Number (EIN) Identification type, and if available on form, the following about the identification: (or documentation to identify the business if the customer is a business entity) Date of issuance Number Date of expiration (No identification presented may be expired.) For military personnel, APO and FPO addresses are permissible, as are street addresses of next of kin. 7

8 We require that the member s identification does include a local, current address, obtain and document a second form of identification with a local or current address, such as a utility bill if you are unsure. Compare the name of the member with any lists of terrorists and terrorist organizations designated by the federal government for this purpose. If the member appears on a government list, notify the BSA officer for further action. Have the member certify his/her social security number on IRS Form W-9 or a Credit Union-approved substitute. If the customer does so, this procedure is complete. Business Entities (Sole Proprietorship/Partnership/certain Non Profit): Obtain and record on the appropriate Credit Union documents the business entity s official legal name and the street address of its principal place of business. Obtain copies of the company s business licenses if they are a partnership. We require a partnership to have a written partnership agreement. We also require a business license or registration depending on the type of partnership. Compare the name of the business entity with any lists of terrorists and terrorist organizations designated by the federal government for this purpose. Obtain and record the entity s TIN. Sole proprietorships may use social security number. We require if transferred from another institution their previous 60 day bank statements on their personal checking accounts. Non-profits must have an organizational TIN. Also we request a copy of By-Laws or the charter. Obtain all of the information listed for individuals for the person who has authority or control over the account, including his or her home address. Verification: The Credit Union is required to verify the identity of the person or entity using the one or more of the following methods (in the Credit Union s discretion): Existing Members The Credit Union has assessed and determined that its prior practices (including its history/relationship) with members having accounts or services with the Credit Union prior to October 1, 2003, provide a sufficient basis for verification of such persons identities in light of the Credit Union s risk assessment of the matter. Natural Persons / Recordkeeping: The Credit Union will record the document(s) used to verify the Member s identification by making a notation of such on the Membership Application and Member Data Sheet 8

9 For a US Person (Not an Individual -- e.g., a corporation, partnership, trust, etc.)! Business Accounts: In all cases, the identification should be checked to ensure that it has not expired.! Partnership Accounts: For partnership accounts, the Credit Union will assess the following together with the Membership Application: Copy of the partnership certificate filed with the local county clerk s office (if available) Partnership agreement.! Organization/Association Accounts: For unincorporated associations, the Credit Union will assess the following together with the Membership Application: Association s constitutional bylaws. Board of trustees minutes authorizing the Credit Union account. Letter from the association s president naming the officers of the association and their signatory powers. What to do When the Credit Union CANNOT Verify a Person's Identity: When the Credit Union is not able to verify a person's identity, the following procedures will be followed:! If the account has not yet been opened, the Credit Union will refuse to open the account if it is not able to form a "reasonable belief" that it knows the true identity of the person in question.! If the account is already opened the Credit Union will place a hold (freeze) on the account until it is able to form a "reasonable belief" that it knows the true identity of the person in question! If the Credit Union is ultimately not able to form a "reasonable belief" that it knows the true identity of the person in question, then the account may be closed. Unless the account is subject to other government requirements and/or restrictions (e.g., OFAC), then the funds will be returned to the "person(s)" with notice that the Credit Union closed the account due o the fact that it was not able to verify the identity of all persons on the account! SAR -- A suspicious activity report (SAR) may be required if the Credit Union believes that a person has attempted to open a new account using a false identification; or as may be required by other applicable provisions of this procedure or applicable laws. All matters involving a SAR will be addressed by the BSA Officer. 9

10 VIII. Member Identification // Emergency Situations: When the Credit Union or its members face emergency situations (such as Hurricane Katrina), the Credit Union may use such procedures as it deems appropriate to address verification of identity consistent with the Guidelines issued by applicable government regulators such as FinCEN and NCUA. NOTE: The Credit Union should be aware that there are always the unscrupulous that will seek to take advantage of such situations. Thus, the Credit Union should consider identity theft and fraud in assessing such procedures in order to protect the true victims of an emergency/disaster; and to protect the Credit Union. IX. Suspicious Activity Reporting If any Credit Union employee becomes aware of or suspects criminal activity by either Credit Union customers or employees, he or she should promptly report the matter to the BSA officer or CEO and complete a BSA Employee Concern Sheet. The BSA officer or CEO will promptly investigate the matter further to determine whether to report the suspicious activity to our primary federal regulator. The investigation will be based on a review of the facts, as submitted by the employee, and a discussion with Credit Union officers in charge of the affected areas. The BSA officer will file a SAR electronically no later than 30 calendar days after the date of initial detection of an act described above. If the Credit Union did not identify a suspect on the date it detected an act triggering the filing, the Credit Union may delay filing a SAR for an additional 30 calendar days after the identification of a suspect. In no case will the Credit Union delay reporting more than 60 calendar days after the date it detected a known or suspected violation. If situations involving violations require immediate attention, however, such as when a reportable violation is ongoing, the Credit Union will immediately notify by telephone, or other expeditious means, the appropriate law enforcement agency and the NCUA in addition to filing a timely report. Management is directed to consult FinCEN's website and review advisories, guidance s and special reports regarding money laundering, including reports on mortgage fraud and international money laundering. Supporting Documentation for the SAR We will not include supporting documentation with the SAR, except as allowed by the BSA E-Filing System, when it is submitted to FinCEN, but will maintain all documentation that supports the facts and circumstances of the report in the SAR file either in hard copy or on computer disk, CD, or on our anti-money laundering software. Confidentiality and Subpoenas: The BSA officer, CEO, and any other staff aware of the matter will keep the information and the fact that a report was filed confidential. Any person subpoenaed or otherwise requested to disclose the filing of a SAR or the information contained in an SAR should decline to produce the information and notify the BSA officer. The officer will then notify NCUA/FinCEN. In addition, management should not place the SAR in the personnel files of any directors, officers, or employees who might be party to the suspicious activity. The board directs management to 10

11 implement risk-based procedures to ensure the confidentiality of SARs. Those procedures may include but are not limited to: Appropriate security measures Limited access to reports on a "need-to-know" basis Restricted areas for reviewing SARs Logging of access to SARs The use of cover sheets for SARs, or supporting documentation that indicates the filing of a SAR, or electronic notices that highlight confidentiality concerns before a person may access or disseminate the information Elder Abuse: An SAR should be filed pursuant to FinCEN s instructions as set forth in the Credit Union s Elder Abuse Procedure. Summary of When to Consider Filing / When Required: A known or suspected violation means any matter for which there is a basis to believe that a violation of a federal criminal statute (including a pattern of criminal violations) has occurred, or has been attempted, is occurring, or may occur, and there is a basis to believe that a financial institution was an actual or potential victim of the criminal violation or was used to facilitate the criminal violation. The Credit Union will file a SAR in the following situations: The Credit Union detects a known or suspected violation of federal criminal law and has substantial basis to believe that one of its directors, officers, employees, agents, or other institution-affiliated parties committed or aided in the commission of the violation. The Credit Union detects a known or suspected violation of federal criminal law involving or aggregating $5,000 or more (before reimbursement or recovery) and has substantial basis for identifying a possible suspect or group of suspects. The Credit Union detects a known or suspected violation of federal criminal law involving or aggregating $25,000 or more (before reimbursement or recovery) and has no substantial basis for identifying a possible suspect or group of suspects. The Credit Union detects transactions aggregating $5,000 or more that involve potential money laundering or violate the BSA. Any transaction means a deposit withdrawal; transfer between accounts; exchange of currency; loan; extension of credit; purchase or sale of any stock, bond, certificate of deposit, or other monetary instrument or investment security; or any other payment, transfer, or delivery by, through, or to a financial institution (by whatever means effected), conducted or attempted by, at, or through the Credit Union and involving or aggregating $5,000 or more in funds or other assets, if the Credit Union knows, suspects, or has reason to suspect that: 11

12 The transaction involves funds derived from illegal activities or is intended or conducted to hide or disguise funds or assets derived from illegal activities (including, without limitation, the ownership, nature, source, location, or control of such funds or assets) as part of a plan to violate or evade any law or regulation or to avoid any transaction reporting requirement under federal law. The transaction is designed to evade any regulations promulgated under the BSA. This includes an attempt at structuring the transaction. The transaction has no business or apparent lawful purpose or is not the sort in which the particular customer would normally be expected to engage, and the institution knows of no reasonable explanation for the transaction after examining the available facts, including the background and possible purpose of the transaction. The Bank Secrecy Act officer will file a SAR no later than 30 calendar days after the date of initial detection of an act described above. If the Credit Union did not identify a suspect on the date it detected an act triggering the filing, the Credit Union may delay filing a SAR for an additional 30 calendar days after the identification of a suspect. In no case will the Credit Union delay reporting more than 60 calendar days after the date it detected a known or suspected violation. If situations involving violations require immediate attention, however, such as when a reportable violation is ongoing, the Credit Union will immediately notify by telephone, or other expeditious means, the appropriate law enforcement agency and the NCUA in addition to filing a timely report. If a currency transaction exceeds $10,000 and is suspicious, the Credit Union will file both a CTR and a SAR. If a currency transaction equals or is below $10,000 but is suspicious, the Credit Union will file only a SAR. The Credit Union will submit the report to FinCEN at the address listed on the most current form, which, from time to time, may be altered by the Treasury Department. Maintaining Accounts After a SAR Has Been Filed The decision whether or not we will keep an account open after a SAR has been filed will be made by the BSA officer and may be made on a case-by-case basis pursuant to the Credit Union s other policies, procedures and/or practices. We will document the decision either to close or keep open the account in the SAR file. If the reported activity is repeated or ongoing this fact will be further considered by the BSA Officer in making an assessment of the actions to take with regard to the accounts and/or services affected. Also, if the activity continues or is ongoing FinCEN s guidelines suggest that financial institutions should report continuing suspicious activity by filing a report at least every 90 days. 12

13 Limits on Closing Accounts/Services: If a law enforcement agency requests that we maintain a particular account, we will ask for the request to be submitted in writing from a federal law enforcement agency. The request should be issued by a supervisory agent or by an attorney within a United States Attorney s Office or another office of the Department of Justice. If a state or local law enforcement agency requests that an account be maintained, then we will obtain a written request from a supervisor of the state or local law enforcement agency or from an attorney within our state or local prosecutor s office. The written request should indicate that the agency has requested that we maintain the account and the purpose of the request. For example, if a state or local law enforcement agency is requesting that we maintain the account for purposes of monitoring, the written request should include a statement to that effect. The request should also indicate the duration for the request. The initial request should not exceed six months. However, law enforcement my make additional requests for the maintenance of the same account after the expiration of the initial request. After the time period expires (or any extension as noted) the Credit Union may close the accounts and/or services per the policies, procedures or practices referred to in this Section. Although there is no recordkeeping requirement under BSA for this type of correspondence, we will maintain documentation of such requests for at least five years after the request has expired. If we are aware through a subpoena, government information request, National Security Letter, or similar communication that an account is under investigation, we will notify law enforcement before making any decision regarding the status of the account. X. At this time UFCU makes it a practice to block transactions from foreign countries. XI. Record Retention The Credit Union will retain all records as required by the Secretary of the Treasury under the BSA. In particular, the Credit Union will retain the original or a copy of the following items for five years after they are effective, as required: Each extension of credit in excess of $10,000 (except those secured by real estate) Each request or instruction given or received for the transfer of funds, checks, securities, or credit of more than $10,000 to anywhere outside of the United States or received from anywhere outside of the United States For each deposit account or certificate, the taxpayer identification number of the customer, or if in the name of two or more individuals, the taxpayer identification number of a person having a financial interest in the account Each signature card for deposit accounts 13

14 Each statement or other record for deposit accounts Each check, draft, or money order drawn on the Credit Union for more than $100 Each item comprising a debit to a customer s accounts in excess of $100 Each item of funds or securities of more than $10,000 remitted or transferred outside of the United States Each check or draft for more than $10,000 drawn on or issued by a foreign bank which the Credit Union has paid or presented to a non-bank drawee for payment Each item in excess of $10,000 that the Credit Union has received directly from outside the United States Each direct receipt of currency, checks, or transfer of funds or credit of more than $10,000 from a bank, broker, or foreign exchange dealer outside of the United States Records from demand deposit accounts that would be needed to reconstruct an account and trace a check of more than $100 deposited into the account Name, address, and taxpayer identification number of the purchaser of each certificate of deposit, along with a description of the instrument, the method of payment, and date of the transaction Name, address, and taxpayer identification number of each person presenting a certificate of deposit for payment, along with a description of the instrument and date of the transaction Each deposit slip or credit ticket (which will reflect the amount of any currency involved), or equivalent record for direct deposits or wire transfers, reflecting a transaction of $100 or more Each CTR submitted by the Credit Union Each exemption granted from the currency reporting requirements, including the name, address, business, taxpayer identification number, account number, type of exemption, and dollar limit, along with the customer s signed statement describing the reason for the exemption Any chronological logs of sales of cashier s checks, traveler s checks, etc. Copy of each SAR filed and it s supporting documentation A copy of all identifying information the Credit Union gathers about the customer at account opening for five years after the account is closed, or in the case of credit cards all identifying information it gathers about the customer for five years after the account is closed or becomes dormant XII. Training The BSA officer will conduct or arrange annual meetings with tellers and other Credit Union personnel who handle currency to keep them informed of any changes to the BSA procedures and to refresh their general training on the BSA. The BSA officer is also responsible for training new tellers and other personnel who handle currency on the Credit Union s BSA procedures at the time of their employment. It will also be the responsibility of the BSA officer to advise the compliance committee of those individuals 14

15 who attended and the issues addressed. The BSA officer will hold additional meetings or other training as necessary to address issues that arise in the interim that must be addressed before the next scheduled meeting. Training may be conducted through presentations at a meeting, circulation of memoranda or other written materials, or any other appropriate manner. The BSA officer will retain a copy of all materials presented or circulated, along with a written record of attendance or receipt by Credit Union personnel. XIII. Audit Procedures/Independent Testing At least once each year, an appropriate person as designated by the requirements of applicable law and regulations will conduct audit procedures. The audit procedures should include but are not limited to the following: Verify that the Credit Union has updated its BSA procedure to reflect any changes in the law or regulations and trained affected personnel on these changes. Verify that each teller and other appropriate employees have signed the initial BSA training form and received a copy. Review the training that the Credit Union conducted during the previous year, and verify that all employees scheduled to receive that training did, in fact, receive it. Verify timely filing of a random sample of CTR. Review a random sample of daily journals of cash transactions to verify that all transactions requiring a report were, in fact, reported. Verify that the Credit Union maintains a supply of CTR forms (FinCEN Form 104) and a file of any completed forms. Verify that exemptions for non-listed business and payroll customers are renewed every two years. Verify that the Credit Union maintains a system of monitoring the transactions in currency of each exempt customer for any and all reportable suspicious activities. Verify that the Credit Union has certified that it has complied with the requirement to maintain a system of monitoring for reportable suspicious activities as part of the required biennial renewal. Review a random sample of certificates of deposit to verify that they contain a description of the source of funds. Review a random sample of loan files to be sure the Credit Union obtained a specific purpose of loans over $10,000 not secured by real estate. Verify that the Credit Union is retaining records required to be retained (items listed in the records retention section of these procedure) for the required five-year period. Verify that the Credit Union is properly retaining information on sales or issuance of Credit Union checks or drafts, cashier s checks, money orders, or traveler s checks that involve $3,000 to $10,000 in currency. 15

16 Verify that the Credit Union is complying with its own customer identification procedures and that those procedures are in compliance with the law. Verify that the Credit Union is in compliance with all sections of the USA Patriot Act of 2001 that pertain to the Credit Union as implemented by the Bank Secrecy Act at 31 CFR 103. Results of the audit will be reported to the compliance committee and the BSA officer. The BSA officer is responsible for taking appropriate action to correct any problems found as a result of the audit. XIV. Anti-Money Laundering Procedures This procedure is adopted by the Credit Union in recognition of the Credit Union s obligations under the Bank Secrecy Act (BSA) and other related money laundering regulations, and the requirements of the NCUA. The Bank Secrecy Act Officer is appointed as the anti-money laundering program coordinator and is responsible for coordinating and monitoring day-to-day compliance with all federal and state laws relating to money laundering. It is the responsibility of the anti-money laundering program coordinator to coordinate and monitor day-to-day compliance with the detection and prevention of money laundering, including the training of Credit Union employees. The board of directors, management, and staff of the Credit Union are committed to implementing policies and procedures that assist in detecting and preventing money laundering or other illegal activities conducted through transactions at the Credit Union. THE MONEY LAUNDERING PROCESS Money laundering is the criminal practice of filtering ill-gotten gains or dirty money through a maze or series of transactions, so the funds are cleaned to look like proceeds from legal activities. Money laundering does not have to involve cash at every stage of the laundering process. Any transaction conducted with a Credit Union might constitute money laundering. Although money laundering is a diverse and often complex process, it involves three independent steps that can occur simultaneously: Placement- The process of placing, through deposits or other means, unlawful cash proceeds into traditional financial institutions. Layering- The process of separating the proceeds of criminal activity from their origin through the use of layers of complex financial transactions, such as converting cash into traveler s checks, money orders, wire transfers, letters of credit, stocks, bonds, or purchasing valuable assets, such as art or jewelry. Integration- The process of using an apparently legitimate transaction to disguise the illicit proceeds, allowing the laundered funds to be disbursed 16

17 back to the criminal. Different types of financial transactions, such as sham loans or false import/export invoices, can be used. POTENTIAL INDICATORS OF MONEY LAUNDERING Structured currency deposits to individual checking accounts, often well below the typical levels for structuring, with multiple daily deposits to multiple accounts at different branches of the same Credit Union on the same day. Consumer checking accounts that are used for a period of time and then become dormant. In some cases, the accounts may have become overdrawn, perhaps as a further means of avoiding detection. Personal checking accounts opened by foreign nationals who come to the Credit Union together. Multiple accounts opened on the same day or held by the same foreign nationals at various banks. Increases in the frequency or amounts of currency deposits made by U.S. business accountholders who export to Colombia. Suspicious transactions that might be linked to a common scheme. Suspicious transactions that may that indicate activity prohibited by FinCEN s Rules limiting the amounts of transfers of currency to Mexican Banks as explained in the SAR portion of this procedure. ANTI-MONEY LAUNDERING DETECTION AND PREVENTION PROCEDURES Monitoring for Suspicious Activity The board of directors instructs management to institute procedures in each department that are designed to detect and prevent money laundering. Management is specifically directed to identify high-risk accounts in the Credit Union's portfolio using the federal banking agency's list of accounts as a guide. In particular, management is directed to perform due diligent procedure on the Credit Union's customers who are money service businesses as defined by the BSA. In addition, the board requires that management and the anti-money laundering program coordinator will ensure that the following reports are monitored for suspicious activity and that employees receive adequate internal and external training on detecting money laundering and other illegal activities: Suspect kite reports- These reports identify excessive activity in accounts and should also be reviewed for cash activity. The account profile of an account used for money laundering can be similar to that of an account used for check kiting: high volume of activity, matching deposits and withdrawals, and low average balances in relation to activity. 17

18 Demand deposit activity reports- These reports cover all customer and employee accounts. They generally show daily balances and accumulated deposits and withdrawals over a 30-day period. These reports may be reviewed manually, or management may establish a threshold for certain types of accounts and then review only the exceptions. Large transaction reports- These reports will be set at an amount lower than $10,000 so that the Credit Union can identify customers who may be structuring transactions to avoid currency transaction report (CTR) reporting or who have unusual activity in their accounts. Incoming and outgoing wire transfer logs- These logs identify transfers of funds out of the country or to remote banks, transfers funded by cashier s checks or money orders in amounts under the CTR filing threshold, and other suspicious activities of both non-customers and accountholders. Overdraft reports- These reports can be used to assist management in discovering whether a previously good customer either individual or commercial is suddenly having financial problems. Commercial service charge analysis reports- Management is directed to establish thresholds for these reports to monitor a change in commercial customers balances, checking, deposit, or currency transactions. Changes in account activity may only mean the company is becoming more successful; however, management is directed to have these reports reviewed by an objective employee. Although the reviewer may need to discuss the account with the relationship officer, that person should not be the last word on whether the activity in the account is suspicious. Delinquent loan reports- Although these reports generally receive special attention, management is directed to pay close attention when delinquent loans are suddenly cured with no reasonable explanation in the file. Loan officers must be able to explain a sudden payoff of seriously delinquent accounts. Expired collateral insurance reports- These reports for personal property and real estate loans are usually the first sign that something is wrong with a loan. Management is directed to instruct operations staff to notify a supervisor or loan officer immediately when a new loan customer fails to purchase initial insurance for the collateral, instead of waiting for the notice letter to go out. Whether this is suspicious or not depends on what other information the Credit Union has about this customer. Hold notices for Regulation CC- Management is directed to train operations or customer service staff to notify a supervisor or officer when they place a hold on a check that is unusual (i.e., in the amount or location of the drawee bank) on a customer s account for the first time. Suspicious Activity Reporting Reporting as to SAR filing will be addressed per the Credit Union s Bank Secrecy Act Policies and Procedures. 18

19 Training The anti-money laundering program coordinator will conduct or arrange for annual meetings with tellers and other Credit Union personnel who handle currency to keep them informed of any new changes to the BSA or other related laws and updates to the Credit Union s anti-money laundering procedures. It is also the responsibility of the anti-money laundering program coordinator to train all employees at the time of their initial employment. Additional meetings or other training will be held as necessary to address issues that arise in the interim. Training may be conducted through presentations at a meeting, circulation of memoranda or other written materials, or any other appropriate manner. A copy of all materials presented or circulated shall be retained by the anti-money laundering program coordinator along with a written record of attendance or receipt by Credit Union personnel. At least once per year, the anti-money laundering program coordinator will attend one external training session relating to the BSA, fraud detection, or money laundering. Audit Procedures/Independent Testing At least once each year, an independent audit of the procedures detailed in this procedure will be conducted by an appropriate person as designated by the requirements of applicable law and regulations. Results of the audit will be reported to the audit committee of the board of directors and the anti-money laundering program coordinator. It is the responsibility of the antimoney laundering program coordinator to take appropriate action to correct any problems found as a result of the audit and respond to the audit committee. 19

20 XV. Office of Foreign Assets Control Procedures The Credit Union establishes this procedure to comply with the Office of Foreign Assets Control (OFAC), which administers a series of laws that impose economic sanctions against targeted hostile foreign countries and groups to further U.S. foreign policy and national security objectives. The laws implemented by OFAC regulations are: The Trading With The Enemy Act (TWEA), 50 USC 1-44 [Cuba, Transaction Control Regulations]. The International Emergency Economic Powers Act (IEEPA), 50 USC , [Diamond Trading, North Korea, Sudan, Iran, Zimbabwe, the Balkans, Terrorism, Narcotics, Nonproliferation, Syria, and Burma]. The Iraqi Sanctions Act (ISA), Pub. L , 104 Stat The United Nations Participation Act (UNPA), 22 USC 287c, applies to Iraq and Diamond Trading. The International Security and Development Cooperation Act (ISDCA), 22 USC 2349aa-9 [Iran]. The Cuban Democracy Act (CDA), 22 USC (relating to Cuba), has the same force of law as TWEA above. The Cuban Liberty and Democratic Solidarity (LIBERTAD) Act, 22 USC (relating to Cuba), has the same fines as TWEA above and codifies the Cuban Assets Control Regulations. The Antiterrorism and Effective Death Penalty Act, enacting 8 USC 219, 18 USC 2332d, and 18 USC 2339b. The Foreign Narcotics Kingpin Designation Act, Pub. L. No , tit. VIII, 113 Stat 1606, (1999) (to be codified at 21 USC ). The Criminal Code, at 18 USC 1001, provides for five years imprisonment and a $10,000 criminal fine for knowingly making false statements or falsifying or concealing material facts when dealing with OFAC in connection with matters under its jurisdiction. To ensure the Credit Union s compliance with the OFAC rules, the board of directors appointed the Bank Secrecy Act Officer who is also charged as the OFAC compliance administrator. The board of directors is responsible for overall Credit Union compliance with OFAC regulations. However, the OFAC compliance administrator is responsible for the day-today management of this function. The OFAC compliance administrator will report 20

21 directly to the board of directors concerning compliance reviews of Credit Union functional areas, regulatory examination reports and answers to those reports, impact of new regulations or changes to existing regulations, and general compliance issues and concerns. The OFAC administrator may delegate these responsibilities in accordance with our directions for the Bank Secrecy Act Officer as noted previously or otherwise in this Procedure. Specifically, the OFAC compliance administrator is responsible for: Maintaining current copies of applicable compliance statutes, regulations, interpretations, and the Specially Designated National (SDN) list or NS-PLC lists Maintaining proficient knowledge of applicable compliance statutes, regulations, and interpretations Formulating and updating bank policies and procedures to maintain bank compliance with applicable compliance statutes, regulations, and interpretations Coordinating the training of bank personnel on bank compliance policies and procedures Monitoring blocked funds and sending appropriate reports FINANCIAL INSTITUTION RESPONSIBILITIES The Credit Union must block fund transfers that are: Remitted by or on behalf of a blocked individual or entity Remitted to or through a blocked entity Remitted in connection with a transaction in which a blocked individual or entity has an interest The Credit Union recognizes that every bank transaction is potentially subject to a blocking under OFAC regulations. U.S. law requires that assets and accounts be blocked when such property is located in the United States, is held by U.S. individuals or entities, or comes into the possession or control of U.S. individuals or entities. As part of its enforcement efforts, OFAC publishes a list of individuals and companies owned or controlled by, or acting for or on behalf of, targeted countries. It also lists individuals, groups, and entities, such as terrorists and narcotics traffickers designated under programs that are not country-specific. Collectively, such individuals and companies are called "Specially Designated Nationals" or "SDNs." Their assets are blocked and U.S. persons are generally prohibited from dealing with them. OFAC also has published a list called NS-PLC. This OFAC list contains the names of individuals who are affiliated with terrorist organizations and have been elected to the Palestinian Authority. The individuals listed on the NS-PLC List are PLC members who were elected on the party slate of an Foreign Terrorist Organization, Specially Designated Terrorist, or Specially Designated Global Terrorist. Their names do not, however, appear on the SDN List. All transactions involving these individuals must be rejected. If the Credit Union receives instructions to make a payment that falls into one of these categories, the Credit Union will execute the payment order and place the funds into a blocked account. A payment order cannot be canceled or amended after the Credit 21