Customer Identification Program And Other Related Compliance Issues

Customer Identification Program And Other Related Compliance Issues Presented by: Deborah L Crawford Gettechnical Inc. 7575 Jefferson Hwy #183 Baton Rouge, LA 70806 1-800-354-3051 www.gettechnical@msn.com

2

BANK SECRECY ACT/ANTIMONEY LAUNDERING PROGRAM RISK ASSESSMENT IDENTIFY & MEASURE RISK Products, Services, Customers and Geographies INTERNAL CONTROLS Develop applicable: Policies, Procedures, Systems and Controls Risk based compliance program Internal Controls Audit Type BSA Compliance Officer Training 3

TWO BIG PIECES ANTI MONEY LAUNDERING PROGRAM (AML) Customer Identification Program & Training Customer Due Diligence, Customer Monitoring Programs & Training Suspicious Activity Awareness and Reporting by Staff and Management 4

COMPLIANCE TASKS TO OPEN ACCOUNTS TASK #1 TASK #2 TASK #3 TASK #4 POSSIBLE TASK #5 POSSIBLE TASK #6 TASK #7 TASK #8 TASK #9 TASK #10 TASK #11 IS IT AN ACCOUNT AND IS IT A CUSTOMER AS COVERED BY? GATHERING THE INFORMATION VERIFYING THE CUSTOMER THROUGH DOCUMENTS VERIFYING THE CUSTOMER THROUGH NONDOCUMENTS WHAT TO DO IF CANNOT VERIFY IDENTITY PLACING A REG CC HOLD RECORDKEEPING COMPARISON WITH GOVERNMENT LISTS (THERE IS NONE AT THIS TIME) ASSIGN RISK OFAC CUSTOMER NOTICE IN LOBBY POSSIBLE TASK #12 RELIANCE ON ANOTHER FINANCIAL INSTITUTION TASK #13 TASK #14 TASK #15 CUSTOMER DUE DILIGENCE PUTTING TOGETHER AND CDD ENHANCED DUE DILIGENCE ASK MORE QUESTIONS ON HIGH RISK ACCOUNTS 5

USA PATRIOT ACT: WHERE THE CHANGE BEGAN FOR NEW ACCOUNTS Overview On October 26, 2001, President Bush signed into law the USA Patriot Act, Public Law 107-56. Title III of the Act captioned International Money Laundering Abatement and Anti-terrorist Financing Act of 2001, adds several new provisions to the Bank Secrecy Act (BSA), 21 U.S.C. 5311 et seq. Section 326 of the Act adds a new subsection (1) to 31 U.S.C. 5318 that requires the Secretary to prescribe regulations setting form minimum standards for financial institutions that relate to the identification and verification of any person who applies to open an account. 6

LAW: USA PATRIOT ACT Section 326. VERIFICATION OF IDENTIFICATION. (a) In General. Section 5318 of title 31, United States Code, as amended by this title, is amended by adding at the end the following: (1) Identification and Verification of Accountholders (1) In general. Subject to the requirements of this subsection, the Secretary of the Treasury shall prescribe regulations setting forth the minimum standards for financial institutions and their customers regarding the identity of the customer that shall apply in connection with the opening of an account at a financial institution. (2) Minimum requirements. The regulations shall, at a minimum, require financial institutions to implement, and customers (after being given adequate notice) to comply with, reasonable procedures for (A) verifying the identity of any person seeking to open an account to the extent reasonable and practicable; (B) Maintaining records of the information used to verify a person s identity, including name, address, and other identifying information; and (C) consulting lists of known or suspected terrorist or terrorist organizations provided to the financial institution by any government agency to determine whether a person seeking to open an account appears on any such list. (3) Factors to be considered. In prescribing regulations under this subsection, the Secretary shall take into consideration the various types of accounts maintained by various types of financial institutions, the various methods of opening accounts, and the various types of identifying information available. (4) Certain financial institutions. In the case of any financial institution the business of which is engaging in financial activities described in section 4(k) of the Bank Holding Company Act of 1956 (including financial activities subject to the jurisdiction of the Commodity Futures Trading Commission), the regulations prescribed by the Secretary under paragraph (1) shall be prescribed jointly with each Federal functional regulator (as defined in section 509 of the Gramm-Leach-Bliley Act, including the Commodity futures Trading Commission) appropriate for such financial institution. (5) Exemptions. The Secretary (and, in the case of any financial institution described in paragraph (4), any Federal agency described in such paragraph) may, by regulation or order, exempt any financial institution or type of account from the requirements of any regulation prescribed under this subsection in accordance with such standards and procedures as the Secretary may prescribe. (6) Effective date. Final regulations prescribed under this subsection shall take effect before the end of the 1-year period beginning on the date of enactment of the International Money Laundering Abatement and Financial Anti-Terrorism Act of 2001. (b) Study and Report Required. Within 6 months after the date of enactment of this Act, the Secretary, in consultation with the Federal functional regulators (as defined in section 509 of the Gramm-Leach- Bliley Act) and other appropriate Government agencies, shall submit a report to the Congress containing recommendations for (1) determining the most timely and effective way to require foreign nationals to provide domestic financial institutions and agencies with appropriate and accurate information, comparable to that which is required of United States nationals, concerning the identity, address, and other related information about such foreign nationals necessary to enable such institutions and agencies to comply with the requirements of this section: (2) requiring foreign nationals to apply for and obtain, before opening an account with a domestic financial institution, an identification number which would function similarly to a Social Security number or tax identification number; and (3) establishing a system for domestic financial institutions and agencies to review information maintained by relevant Government agencies for purposes of verifying the identities of foreign nationals seeking to open accounts at those institutions and agencies. 7

CUSTOMER IDENTIFICATION PROGRAM (): BSA REQUIREMENTS 1. Overview The regulations are added to the Bank Secrecy Act in an attempt to deter terrorism and money laundering. These regulations require all financial institutions to implement a Customer Identification Program. Identify the customer once at the beginning of the relationship. 2. Purpose The regulations must contain certain requirements. At a minimum the regulations must require financial institutions to implement reasonable procedures for Verifying the identity of any person who opens an account to the extent reasonable and practicable; Maintaining records of the information used to verify the person s identity, including name, address, and other identifying information; and Determining whether the person appears on any lists of known or suspected terrorists of terrorist organizations provided to the financial institution by any government agency. 8

TASK #1: IS IT AN ACCOUNT OR A CUSTOMER AS DEFINED IN? DEFINITIONS ACCOUNT Is it a deposit account or safekeeping account where the customer signed a contract? Make sure you count Certificates of Deposit CUSTOMER Does this customer have an existing account with the bank? If no, then needs. If yes, still have to do Customer Due Diligence Remember that customer can mean different things on different kinds of accounts. Phase I CTR Exemptions are exempt from but not from Customer Due Diligence 9

Type of Account Who is the customer? Personal Accounts Business Accounts and Entities Minor Accounts Power of Attorney Guardianships Escrow Accounts All owners under. If the bank s policy says to signers also, then you will have to authorized signers, agents or convenience signers. The business is the customer. You run on business unless your policy requires you to all the signers also. By the way does the policy say to signers on resolution or on signature card. It still might be Customer Due Diligence to identify the person transacting the business even if you do not identify all signers You the adult acting for the child if the child lacks legal capacity. You the child if he or she is signing the contract. For example when a minor is a joint owner. You the owner (s) unless he or she is incapacitated and then you the power of attorney acting for the customer. You the guardian who is acting for someone who is legally incapacitated. You are not required to the person the agent is acting for. You just the escrow agent. 10

ACCOUNT 1. Account Account means a formal banking relationship established to provide or engage in services, dealings, or other financial transactions including a deposit account, a transaction or asset account, a credit account, or other extension of credit. Account also includes a relationship established to provide a safety deposit box or other safekeeping services, or cash management, custodian, and trust services. Account does not include: a. A product or service where a formal banking relationship is not established with a person, such as check-cashing, wire transfer, or sale of a check or money order; b. An account that the bank acquires through an acquisition, merger, purchase of assets, or assumption of liabilities; or c. An account opened for the purpose of participating in an employee benefit plan established under the Employee Retirement Income Security Act of 1974. Key points: Business relationship was deleted from the final definition to exclude the bank s own business dealings in the operation of the bank. The new revised definition now has a list of what is included. The new definition also has a list of what is excluded such as sales of money orders, wires, etc. These already have recordkeeping requirements. Also, the new definition excludes any accounts acquired through merger, acquisition, purchase of assets, or assumption of liabilities from any third party. These transfers are not initiated by the customer and therefore do not constitute an account. The new definition excluded accounts of employee benefit plans since these come generally from payroll deductions and are not high risk for money laundering and terrorism. 31 C.F.R. 103.121(a)(1) -- Definition of account 1. The rule applies to a customer, which is generally a person that opens a new account. (Emphasis added.) At what point does the rule apply when the account is a loan? When is the account opened? Customer does not include a person who does not receive banking services, such as a person whose loan application is denied. See 68 FR 25090, 25093 (May 9, 2003). Therefore, when the account is a 11

loan, the account is opened when the bank enters into an enforceable agreement to provide a loan to the customer. (January 2004) 2. Are loan participations purchased from third parties and loans purchased from a car dealer or mortgage broker within the exclusion from the definition of account for loans acquired through an acquisition, merger, purchase of assets, or assumption of liabilities? Yes, this exclusion is intended to cover loan participations purchased from third parties and loans purchased from a car dealer or mortgage broker. If, however, the bank is extending credit to the borrower using a car dealer or mortgage broker as its agent, then it must ensure that the dealer or broker is performing the bank s. (January 2004) 3. Are data processing, data warehousing, and data transmission on behalf of a person an account? Account is defined to mean a formal banking relationship established to provide or engage in services, dealings, or other financial transactions including a deposit account, a transaction or asset account, a credit account, or other extension of credit. Account also includes a relationship established to provide a safety deposit box or other safekeeping services, or cash management, custodian and trust services. The examples provided in 31 C.F.R. 103.121(a)(1) of formal banking relationships included within the meaning of account focus on bank products and services that relate to the deposit, lending or custody of funds or other assets on behalf of a customer. Data processing, warehousing, and transmission services generally do not involve a service, dealing, or financial transaction that, taken alone, constitutes a formal banking relationship within the meaning of 31 C.F.R. 103.121(a)(1). If, however, any of these services are part of the establishment of a formal banking relationship, then the rule in 31 C.F.R. 103.121 would apply. (April 2005) 12

BANK Bank means a. A bank, as that term is defined in Section 103.11(c), that is subject to regulation by a Federal functional regulator; and b. A credit union, private bank, and trust company, as set forth in Section 103.11(c), that does not have a Federal functional regulator. Key points: Foreign branches of US banks are not covered in the final rule. must be a part of a bank s BSA compliance program. Therefore it will apply through such a bank s U.S. operations (including subsidiaries) in the same way as the BSA compliance program requirement. However, all subsidiaries that are in compliance with a separately applicable, industry specific rule implementing section 326 will be deemed to be in compliance with this final rule 31 C.F.R. 103.121(a)(2) -- Definition of bank 1. Is the rule applicable to a bank s foreign subsidiaries? No. The rule does not apply to any part of the bank located outside of the United States. Nevertheless, as a matter of safety and soundness, banks are encouraged to implement an effective throughout their operations, including in their foreign offices, except to the extent that the requirements of the rule would conflict with local law. (January 2004) 2. Is the rule applicable to bank holding companies and their non-bank subsidiaries, or to savings and loan holding companies and their non-savings association subsidiaries? No, the rule in 31 C.F.R. 103.121 applies only to a bank. A bank holding company is not subject to the rule solely because it owns a bank. However, a bank holding company may be subject to another rule. For example, if the company is a broker-dealer in securities, it would be subject to 31 C.F.R. 103.122. Similarly, a non-bank subsidiary of a bank holding company is not subject to the rule for banks solely as a result of being affiliated with a bank in a holding company structure. However, a non-bank subsidiary may be subject to one of the other rules. Even if a bank holding company is not itself subject to the rule under 31 C.F.R. 103.121, it should, as a matter of safety and soundness, take appropriate measures throughout its organization to ensure that each entity is in compliance with any applicable rule, to ensure that new accounts receive appropriate due diligence, and generally to protect the consolidated organization from risks associated with money laundering and financial crime. 13

The analysis set forth above is equally applicable to savings and loan holding companies and their nonsavings association subsidiaries. (April 2005) 3. Should subsidiaries of a bank implement a customer identification program? Yes. The Federal banking agencies take the position that implementation of customer identification programs by subsidiaries of banks is appropriate as a matter of safety and soundness and protection from reputational risks. Subsidiaries (other than functionally regulated subsidiaries) of banks should comply with the customer identification program rule that applies to the parent bank when opening an account within the meaning of 31 C.F.R. 103.121. In addition, a number of the Federal banking agencies have separately issued rules that require certain subsidiaries of banks to conduct their activities pursuant to the same terms and conditions that apply to the conduct of such activities by the parent bank. See, e.g., 12 C.F.R. 5.34 (OCC); 12 C.F.R. 559.3(h) (OTS). Some functionally regulated subsidiaries of banks are already subject to a customer identification program rule issued jointly by their functional regulator and FinCEN (i.e., 31 C.F.R. 103.122 (brokerdealers); 31 C.F.R. 103.131 (mutual funds); and 31 C.F.R. 103.123 (futures commission merchants and introducing brokers)). For purposes of the requirements imposed under section 326 of the USA PATRIOT Act, functionally regulated subsidiaries are: broker-dealers, investment companies, investment advisers registered with the SEC, persons licensed to provide insurance, and any entity with respect to a financial activity that is subject to the jurisdiction of the CFTC (such as futures commission merchants, introducing brokers, commodity trading advisors, commodity pools, and commodity pool operators). See 31 U.S.C. 5318(l)(4); 15 U.S.C. 6805, 6809. Subsidiaries of banks that are functionally regulated by the SEC or the CFTC are required to comply with the applicable rules issued by the SEC or CFTC, respectively, and FinCEN. The Federal banking agencies, SEC, CFTC, Department of the Treasury, and FinCEN have worked together to create uniform rules that minimize potential conflicts or differences between the agencies rules. In addition, Treasury and FinCEN intend to issue customer identification program rules applicable to other types of financial institutions in the future. (April 2005) 14

CUSTOMER Customer means: i) A person that opens a new account; and ii) An individual who opens a new account for: a. An individual who lacks legal capacity, such as a minor; or b. An entity that is not a legal person, such as a civic club. Customer does not include: i) A financial institution regulated by a Federal functional regulator or a bank regulated by a state bank regulator; ii) A person described in Section 103.22 (d)(2)(ii)-(iv); or These are Phase I Exemptions iii) A person that has an existing account with the bank, provided that the bank has a reasonable belief that it knows the true identity of the person. (To do this you had to grandfather existing customers 10-1-2003 in your policy). Verification of identification will not be required for existing customers of a bank if the bank has a reasonable belief that it knows the identity of the customer. The new definition does not include Phase I exemptions government entities, business traded on the stock exchanges, their subsidiaries, financial institutions The new definition a person that opens a new account would not require the bank to look through trust, escrow, or similar accounts to verify the identities of beneficiaries and instead would only require the bank to identify the named accountholder. In the case of brokered deposits, the customer will be the broker that opens the deposit account. The final rule provides that customer means an individual who opens a new account for (1) an individual who lacks legal capacity, such as a minor; or (2) an entity that is not a legal person, such as a civic club. The final rule took out signatories as customers but stated on risk based assessment of a new account, a bank may need to take additional steps to verify the identity of the customer by seeking information about individuals with ownership or control over the account in order to identify the customer. You will have to address situations when you will take additional steps to verify the identity of the customer. has many exemptions on businesses but this only applies to their domestic operations 15

31 C.F.R. 103.121(a)(3) -- Definition of customer 1. Who is the customer when an account is opened by an individual who has power-of- attorney for a competent person who is the named owner of the account? The rule provides that a customer generally is a person that opens a new account. 31 C.F.R. 103.121(a)(3)(i)(A). When an account is opened by an individual who has power-of-attorney for a competent person, the individual with a power-of-attorney is merely an agent acting on behalf of the person that opens the account. Therefore, the customer will be the named owner of the account rather than the individual with a power-of-attorney over the account. By contrast, an individual with power-ofattorney will be the customer if the account is opened for a person who lacks legal capacity. 31 C.F.R. 103.121(a)(3)(i)(B)(1). (January 2004) 2. Is a person who becomes co-owner of an existing deposit account a customer to whom the rule applies? Yes, a person who becomes the co-owner of an existing deposit account is a customer subject to the rule because that person is establishing a new account relationship with the bank. (January 2004) 3. Is a new borrower who is substituted for an existing borrower through an assumption of a loan a customer to whom the rule applies? Yes, a new borrower who is substituted for an existing borrower through an assumption of a loan is a customer because the new borrower is establishing a new account relationship with the bank. (January 2004) 4. The rule requires a bank to verify the identity of each customer. Under the rule, a customer generally is defined as a person that opens a new account. If a pension plan administrator chooses to remove a former employee from the plan pursuant to section 657(c) of the Economic Growth and Tax Relief Reconciliation Act of 2001 (EGTRRA), it is required by law to transfer these funds to a financial institution. In addition, an administrator of a terminated plan may remove former employees that it is unable to locate, by transferring their benefits to a financial institution. Would a plan administrator or the former employee be a bank customer where funds are transferred to a bank and an account established in the name of the former employee, in either of these situations? In either situation, the administrator has no ownership interest in or other right to the funds, and therefore, is not the bank s customer. Nor would we view the administrator as acting as the customer s agent when the administrator transfers the funds of former employees in these situations. A customer relationship arises and the requirements of the rule are implicated when the former employee opens an account. While the former employee has a legally enforceable right to the funds that are transferred to the bank, the employee has not exercised that right until he or she contacts the bank to assert an ownership interest. Thus, in light of the requirements imposed on the plan administrator under EGTRRA, as well as the requirements in connection with plan terminations, the former employee will not be deemed to have opened a new account for purposes of the rule until he or she contacts the bank to assert an ownership interest over the funds, at which time a bank will be required to implement its with respect to the former employee. 16

This interpretation applies only to (1) transfers of funds as required under section 657(c) of EGTRRA, and (2) transfers to banks by administrators of terminated plans in the name of participants that they have been unable to locate, or who have been notified of termination but have not responded, and should not be construed to apply to any other transfer of funds that may constitute opening an account. (January 2004) 5. A bank is an agent for a (bank) credit card issuer. The cards are co-branded, the two banks share in the revenue from the cards issued. However, the issuer approves the credit card applications and handles collections. Is a person who obtains a credit card a customer of the agent bank or the card issuer? A person who receives a credit card is receiving an extension of credit from, and therefore is establishing an account with, the issuing bank. The agent bank is compensated by the issuing bank and not by the customer. For these reasons, the issuing bank is responsible for ensuring that its applies to the customer. However, the agent bank may perform parts of the on behalf of the issuing bank. As with any other responsibility performed by an agent, the issuing bank ultimately is responsible for the agent s compliance with the requirements of the rule. See 68 FR 25090, 25104 (May 9, 2003). Alternatively, the issuing bank may rely upon the agent bank to perform elements of its, provided that the issuing bank is able to satisfy the requirements of the reliance provision, 31 C.F.R. 103.121(b)(6), including the requirement that the person be a customer of both the issuing and agent bank. (January 2004) 6. Does the rule prohibit a minor from opening an account? No, the rule does not bar a minor from opening an account. It merely states that the bank s customer is the individual who opens the account for an individual who lacks legal capacity, such as a minor. In other words, if a parent opens an account for a minor, the bank s customer is the parent. If, however, a minor opens the account, then the minor is the bank s customer. For example, where a bank sends its employees to elementary schools so that students may open savings accounts as part of a program to promote financial literacy, a student opening an account is the bank s customer. In this situation, as for all customers, the bank should get the name, address, date of birth, and taxpayer identification number of the student. Since verification procedures are risk-based, banks can use any reasonable documentary or non-documentary method to verify a student s identity. In this case, the bank might verify a student s identity using a student identification card or by having the student s teacher confirm the student s identity. (April 2005) 7. The definition of account excludes accounts opened for the purpose of participating in an employee benefit plan established under the Employee Retirement Income Security Act of 1974 (ERISA). In the case of a trust, custodial, or other administrative account established by an employer at a bank to maintain and administer assets under a non-erisa employee retirement, benefit, or deferred compensation plan, who is the bank's "customer?" Is a participant in or beneficiary of such an account the customer? In the case of these accounts (including, for example, accounts established by governmental entities to administer retirement or benefit plans or by employers to administer stock option or restricted stock plans) that are established as trusts, the bank s customer will be the trust established by the employer to maintain the assets. If the account is not a trust, the bank s customer will be the employer that contracts with the bank to establish the account.* Based on the bank's risk assessment of any new account opened by a customer that is not an individual, the bank may need "to obtain information about" individuals with 17

authority or control over such an account, including signatories, in order to verify the customer's identity. See 31 C.F.R. 103.121(b)(2)(ii)(C). For purposes of the rule, a participant in or beneficiary of such an account will not be deemed to be the bank s customer, as such a person will not have initiated the relationship with the bank. The account will not be considered opened by the employee even if a subaccount is maintained in the employee s name, or the employee is able to make deposits into the account, so long as such ability to make deposits is limited to rolling over assets from another plan, purchasing securities or exercising options to purchase securities issued by the employer, or repaying a loan, in accordance with the terms of the plan. By contrast, where an individual opens an individual retirement account in a bank, the individual who opens the account is the bank's "customer." (April 2005) * Note, however, that the rule will not apply if the employer is exempt from the definition of customer under 31 C.F.R. 103.121(a)(3)(ii). 8. Does the definition of "customer" include the relationship with an investor that is established when a bank acts as a registered transfer agent for an issuer, for example, when it effects transactions for the investor in the securities of an issuer as part of the issuer's dividend reinvestment plan or as part of the plan or program for the purchase or sale of that issuer's shares in a manner that does not cause the bank to be a broker under the Securities Exchange Act of 1934? No. A bank that is a registered transfer agent is acting as agent of the issuer of securities. The relationship with the investor does not constitute a formal banking relationship established to engage in services, dealings, or other financial transactions with the investor in these situations. Thus, the bank s relationship with the investor does not constitute a customer relationship. With respect to a bank acting as a transfer agent for its own securities, such bank is dealing with shareholders as shareholders and not as customers. (April 2005) 9. Who is the customer for purposes of trust accounts? Does it make a difference whether the bank or a third party is trustee for the trust? In the case of a trust account, the customer is the trust whether or not the bank is the trustee for the trust. A bank will not be required to look through trust, escrow, or similar accounts to verify the identities of beneficiaries and instead will only be required to verify the identity of the named accountholder. See 68 FR 25090, 25094 (May 9, 2003). However, the rule also provides that, based on the bank s risk assessment of a new account opened by a customer that is not an individual, the bank may need to obtain information about individuals with authority or control over such an account, including signatories, in order to verify the customer s identity. See 31 C.F.R. 103.121(b)(2)(ii)(C). For example, in certain circumstances involving revocable trusts, the bank may need to gather information about the settlor, grantor, trustee, or other persons with the authority to direct the trustee, and who thus have authority or control over the account, in order to establish the true identity of the customer. (April 2005) 10. Who is the customer for purposes of escrow accounts? An escrow account is an account generally established for the deposit of funds that are to be paid to a specified party on the fulfillment of escrow conditions or returned. If a bank establishes an account in the 18

name of a third party, such as a real estate agent, who is acting as escrow agent, then the bank s customer will be the escrow agent. If the bank is the escrow agent, then the person who establishes the account is the bank s customer. For example, if the purchaser of real estate directly opens an escrow account and deposits funds to be paid to the seller upon satisfaction of specified conditions, the bank s customer will be the purchaser. Further, if a company in formation establishes an escrow account for investors to deposit their subscriptions pending receipt of a required minimum amount, the bank s customer will be the company in formation (or if not yet a legal entity, the person opening the account on its behalf). A bank will not be required to look through trust, escrow, or similar accounts to verify the identities of beneficiaries and instead will only be required to verify the identity of the named accountholder. See 68 FR 25090, 25094 (May 9, 2003). However, the rule also provides that, based on the bank s risk assessment of a new account opened by a customer that is not an individual, the bank may need to obtain information about individuals with authority or control over such an account, including signatories, in order to verify the customer s identity. See 31 C.F.R. 103.121(b)(2)(ii)(C). (April 2005) 31 C.F.R. 103.121(a)(3)(ii)(C) Person with an existing account 1. A loan and a time deposit are each an account for purposes of the rule. How do the requirements of the rule apply to a loan that is renewed, or a certificate of deposit that is rolled over? The rule applies to a customer, generally, a person that opens a new account. 31 C.F.R. 103.121(a)(3)(i). (Emphasis added.) Account means a formal banking relationship established to provide or engage in services, dealings, or other financial transactions including a deposit account, a transaction or asset account, a credit account, or other extension of credit. 31 C.F.R. 103.121(a)(1)(i). For purposes of the rule, each time a loan is renewed or a certificate of deposit is rolled over, the bank establishes another formal banking relationship and a new account is established. However, the rule provides that the term customer does not include a person that has an existing account with the bank, provided that the bank has a reasonable belief that it knows the true identity of the person. 31 C.F.R. 103.121(a)(3)(ii)(C). In each of these cases, the customer has an existing account. Therefore, as long as the bank has a reasonable belief that it knows the person s true identity, the bank need not perform its when a loan is renewed or certificate of deposit is rolled over. However, if a new customer is added to the loan or deposit account, the bank would need to satisfy the rule with respect to that new account relationship. (January 2004) 2. Does the exclusion from the definition of customer in 31 C.F.R. 103.121(a)(3)(ii)(C) for a person with an existing account extend to a person who has had an account with the bank in the last twelve months but who no longer has an account? No, this provision only excludes from the definition of customer a person that at the time a new account is opened currently has an existing account with the bank, and only if the bank has a reasonable belief that it knows the true identity of the person. Therefore, for example, when a person has a deposit account and subsequently obtains a loan, the person has an existing account with the bank. Conversely, a person would not be deemed to have an existing account at the bank if the person had a loan, paid it off, and twelve months later obtains a new loan. (January 2004) 3. How can a bank demonstrate that it has a reasonable belief that it knows the true identity of a person with an existing account with respect to persons that had accounts with the bank as of October 1, 2003? 19

Among the ways a bank can demonstrate that it has a reasonable belief is by showing that prior to the issuance of the final rule, it had comparable procedures in place to verify the identity of persons that had accounts with the bank as of October 1, 2003, though the bank may not have gathered the very same information about such persons as required by the final rule. Alternative means include showing that the bank has had an active and longstanding relationship with a particular person, evidenced by such things as a history of account statements sent to the person, information sent to the IRS about the person s accounts without issue, loans made and repaid, or other services performed for the person over a period of time. This alternative, however, may not suffice for persons that the bank has deemed to be high risk. (January 2004) 4. Can a bank exclude from the definition of customer a person that has an existing account with its affiliate? No, a person that has an existing account with a bank affiliate does not qualify as a person who has an existing account with the bank within the meaning of 31 C.F.R. 103.121(a)(3)(ii)(C). However, the bank may be able to rely on its affiliate to perform elements of its, as provided in 31 C.F.R. 103.121(b)(6). (January 2004) Other Definitions Federal Functional regulator is defined at Section 103.120 (a) (2). Financial institution is defined at 31 U.S.C. 531(a)(2) and (c)(1). Taxpayer identification number Defined by section 6109 of the Internal Revenue code of 1986 (26 U.S. C. 6109) and the Internal Revenue Service regulations implementing that section ( e.g., social security or employer identification number). U.S. Person means: i) A U.S. citizen; or ii) A person other than an individual (such as a corporation, partnership, or trust), that is established or organized under the laws of a State or the United States. A Non-U.S. person means a person that is not a U.S. person. The bank will have to ask each customer for a U.S. taxpayer identification number (social security number, employer identification number, or individual taxpayer identification number). If a customer cannot provide one, the bank may then accept alternative forms of identification. 20

COMPLIANCE NEW ACCOUNT INTERVIEW COMPONENTS Information Required (Prior to opening an account) + Verification through documents (Reasonable time after opening account*) + Nondocumentary verification (Reasonable time after opening account*) + 326 Government List Check + Recordkeeping + Customer Notice = COMPLIANCE *Some banks require documents and nondocument verification before account is opened. You must follow your. 21

LAW: INFORMATION REQUIRED BY (i) Customer information required. (A) In general. The must contain procedures for opening an account that specify the identifying information that will be obtained from each customer. Except as permitted by paragraphs (b)(2)(i)(b) and (C) of this section, the bank must obtain, at a minimum, the following information from the customer prior to opening an account: ( 1) Name; (2) Date of birth, for an individual; (3) Address, which shall be: (i) For an individual, a residential or business street address; (ii) For an individual who does not have a residential or business street address, an Army Post Office (APO) or Fleet Post Office (FPO) box number, or the residential or business street address of next of kin or of another contact individual; or ( iii) For a person other than an individual (such as a corporation, partnership, or trust), a principal place of business, local office, or other physical location; and (4) Identification number, which shall be: (i) For a U.S. person, a taxpayer identification number; or (ii) For a non-u.s. person, one or more of the following: a taxpayer identification number; passport number and country of issuance; alien identification card number; or number and country of issuance of any other government-issued document evidencing nationality or residence and bearing a photograph or similar safeguard. Note to paragraph (b)(2)(i)(a)(4)(ii): When opening an account for a foreign business or enterprise that does not have an identification number, the bank must request alternative government-issued documentation certifying the existence of the business or enterprise. (B) Exception for persons applying for a taxpayer identification number. Instead of obtaining a taxpayer identification number from a customer prior to opening the account, the may include procedures for opening an account for a customer that has applied for, but has not received, a taxpayer identification number. In the case, the must include procedures to confirm that the application was filed before the customer opens the account and to obtain the taxpayer identification number within a reasonable period of time after the account is opened. 22

31 C.F.R. 103.121(b)(2)(i) -- Information required 1. What address should be obtained for customers who live in rural areas who do not have a residential or business address or the residential or business address of next of kin or another contact individual? For example, is a rural route number acceptable? Yes, the number on the roadside mailbox on a rural route is acceptable as an address. A rural route number, unlike a post office box number, is a description of the approximate area where the customer can be located. In the absence of such a number, and in the absence of a residential or business address for next of kin or another contact individual, a description of the customer s physical location will suffice. (January 2004) 2. Can a bank open an account for a U.S. person that does not have a taxpayer identification number? No, the bank cannot unless the customer has applied for a taxpayer identification number, the bank confirms that the application was filed before the customer opened the account, and the bank obtains the taxpayer identification number within a reasonable period of time after the account is opened. Note, however, that a bank does not need to obtain a taxpayer identification number when opening a new account for a customer that has an existing account, as long as the bank has a reasonable belief that it knows the true identity of the customer. A bank may also open an account for a person who lacks legal capacity with the identifying information, including taxpayer identification number, of an individual who opens an account for that person. (January 2004) 3. The rule requires a bank to obtain a taxpayer identification number from the customer prior to opening an account from a customer that is a U.S. person. When the bank s customer is a trust, what taxpayer identification number should the bank obtain? The taxpayer identification number for a trust is the trust s employer identification number (EIN). If the trust is not required to have an EIN under the tax laws, then the bank may obtain the grantor s taxpayer identification number, consistent with section 6109 of the Internal Revenue Code and the regulations there under. (April 2005) 23

TASK #2 THE INFORMATION Information Required Name (As it appears on Primary Identification) Date of birth, if individual Residential or business address of customer or next of kin or contact individual Identification Number (US Person versus Non Us Person*) *To open an account for a nonresident alien. says ITIN, Passport or other such number. W-8BEN instructions require an ITIN on an interest-bearing account. 24

WORKSHEET ON INFORMATION New Existing PROFILE PERSONAL ACCOUNTS COMPLETE PROFILE FOR EACH OWNER OR FIDUCIARY ON ACCOUNT (SOME BANKS MAY REQUIRE ONE ON EVERY SIGNER) CUSTOMER NAME (AS IT APPEARS ON PRIMARY IDENTIFICATION) PHYSICAL ADDRESS DATE OF BIRTH SSN OR ITIN (IF NO SSN OR ITIN, PASSPORT NUMBER OR OTHER IDENTIFICATION NUMBER) 25

New Existing Exempt PROFILE BUSINESS ACCOUNTS COMPLETE PROFILE IF YOUR BANK REQUIRES INFORMATION ON ALL SIGNERS THEN USE PERSONAL SHEET ABOVE BUSINESS NAME OR DBA NAME (AS IT APPEARS ON GOVERNMENT ISSUED DOCUMENT) PHYSICAL ADDRESS SSN OR EIN Sole Proprietors and Single member LLCs may use SSN of the owner 26

TASK 3 AND 4 VERIFICATION DOCUMENTARY AND NONDOCUMENTARY VERIFICATION Section 103.121 (b) (ii) Customer Verification. The must contain procedures for verifying the identity of the customer, using information obtained in accordance with paragraph (b)(2)(i) of this section, within a reasonable time after the account is opened. The procedures must enable the bank to form a reasonable belief that it knows the true identity of each customer. These procedures must be based on the bank s assessment of the relevant risks, including those presented by the various types of accounts maintained by the bank, the various methods of opening accounts provided by the bank, the various types of identifying information available, and the bank s size, location, and customer base. At a minimum, these procedures must contain the elements described in this paragraph (b)(2). A) Verification through documents. For a bank relying on documents, the Customer Identification Program must contain procedures that set forth the documents that the bank will use. These documents may include: 1) For an individual, unexpired government-issued identification evidencing nationality or residence and bearing a photograph or similar safeguard, such as a driver s license or passport; and 2) For a person other than an individual (such as corporations, partnerships, or trust), documents showing the existence of the entity, such as certified articles of incorporation, a government-issued business license, partnership agreement, or trust instrument. B) Verification through non-documentary methods. For a bank relying on non-documentary methods, the must contain procedures that describe the non-documentary methods the bank will. 1) These methods may include contacting a customer; independently verifying the customer s identity through the comparison of information provided by the customer with information obtained from a consumer reporting agency, public database, or other source; checking references with other financial institutions; and obtaining a financial statement. 2) The bank s non-documentary procedures must address situations where an individual is unable to present an unexpired government-issued identification document that bears a photograph or similar safeguard; the bank is not familiar with the documents presented; the account is opened without obtaining documents; the customer opens the account without appearing in person at the bank; and where the bank is otherwise presented with circumstances that increase the risk that the bank will be unable to verify the true identity of a customer through documents. 27

C) Additional verification for certain customers. The must address situations where, based on the bank s risk assessment of a new account opened by a customer that is not an individual, the bank will obtain information about the individuals with authority or control over such account, including signatories, in order to verify the customer s identity. This verification method applies only when the bank cannot verify the customer s true identity using the verification methods described in paragraphs (b)(2)(ii)(a) and (B) of this section. 31 C.F.R. 103.121(b)(2)(ii) -- Customer verification 1. Must a bank verify the accuracy of all of the identifying information it collects in connection with 31 C.F.R. 103.121(b)(2)(i)? The final rule provides that a bank s must contain procedures for verifying the identity of the customer, using the information obtained in accordance with paragraph (b)(2)(i), namely the identifying information obtained by the bank. 31 C.F.R. 103.121(b)(2)(ii). A bank need not establish the accuracy of every element of identifying information obtained but must do so for enough information to form a reasonable belief it knows the true identity of the customer. See 68 FR 25090, 25099 (May 9, 2003). (January 2004) 2. Can a bank use an employee identification card as the sole means to verify a customer s identity? A bank using documentary methods to verify a customer s identity must have procedures that set forth the documents that the bank will use. The rule gives examples of types of documents that have long been considered primary sources of identification and reflects the Agencies expectation that banks will obtain government-issued identification from most customers. However, other forms of identification may be used if they enable the bank to form a reasonable belief that it knows the true identity of the customer. Nonetheless, given the availability of counterfeit and fraudulently obtained documents, a bank is encouraged to obtain more than a single document to ensure that it has a reasonable belief that it knows the customer s true identity. (January 2004) 3. Can a bank use an electronic credential, such as a digital certificate, as a non-documentary means to verify the identity of a customer that opens an account over the Internet or through some other purely electronic channel? A bank may obtain an electronic credential, such as a digital certificate, as one of the methods it uses to verify a customer s identity. However, the rule requires the bank to have a reasonable belief that it knows the true identity of the customer. Therefore, for example, the bank is responsible for ensuring that the third party uses the same level of authentication as the bank itself would use. See also FFIEC guidance titled Authentication in an Electronic Banking Environment (July 30, 2001). (January 2004) 4. How should a bank verify the identity of a partnership that opens a new account when there are no documents or non-documentary methods that will establish the identity of the partnership? 28

A bank opening an account for such a partnership must undertake additional verification by obtaining information about the identity of any individual with authority or control over the partnership account, in order to verify the partnership s identity, as described in 31 C.F.R. 103.121(b)(2)(ii)(C). (January 2004) 5. How should a bank verify the identity of a sole proprietorship that opens a new account, (such as an account titled in the name of an individual doing business as a sole proprietorship) when there are no documents or non-documentary methods that will establish the identity of the sole proprietorship? In some states, sole proprietorships are required to file fictitious or assumed name certificates. Banks may choose to use these certificates as a means to verify the identity of a sole proprietorship, if appropriate. However, when there are no documents or nondocumentary methods that will establish the identity of the sole proprietorship, the bank must undertake additional verification by obtaining information about the sole proprietor or any other individual with authority or control over the sole proprietorship account -- such as the name, address, date of birth, and taxpayer identification number of the sole proprietor, or any other individual with authority or control over the account -- in order to verify the sole proprietorship s identity, as described in 31 C.F.R. 103.121(b)(2)(ii)(C). (January 2004) 29

TASK #3 THE DOCUMENTS It has always been due diligence to require two forms of identification such as one primary and a secondary piece of identification to prevent fraud and money laundering at new accounts. It would seem prudent to identify in your policy what types of identification your bank will accept. Here are some suggestions. SUMMARY OF TYPES OF IDENTIFICATION GENERALLY, RECOMMENDED THAT YOU GET ONE PRIMARY AND A SECONDARY PIECE OF IDENTIFICATION PRIMARY SECONDARY UNACCEPTABLE SHOULD INCLUDE PICTURE, DESCRIPTION AND SIGNATURE HAS SOME BUT NOT ALL OF THE COMPONENTS OF PRIMARY ID EASILY STOLEN, EASILY REPRODUCED NOT ACCEPTED AS ID GENERALLY Driver s License/ non driver s identification card Passport US Government US Military Alien registration card Primary identification include picture, description of person, and signature. Should be accompanied with a second piece of identification. Use bar books to verify primary identification. See http://www.idcheckingguide.com Social Security card Voter s registration Birth Certificate Credit cards Bank cards State government Local government Company identification Police identification Insurance Cards Secondary identification has components of primary but not considered as primary. Acceptable as a second piece of identification. Never acceptable to open an account alone. Hunting license Marriage license Rotary club card Library card Blockbuster video card Sam s club card Panty hose card Country club card Never acceptable as identification. This is a short list. There are many, many forms of identification which are unacceptable. 30

EXPANDED IDENTIFICATION FOR NONRESIDENT ALIENS (NRA) You can keep to a very narrow Customer Identification Program (). You can say no passport no account. This makes things very simple for the bank. However depending on your market, you may want to write into your BSA/ policy a specific policy for non resident aliens. PRIMARY SHOULD INCLUDE PICTURE, DESCRIPTION AND SIGNATURE SECONDARY HAS SOME BUT NOT ALL OF THE COMPONENTS OF PRIMARY ID State issued non driver s identification card Passport Primary identification Should include a picture, description of person, and signature. Should be accompanied with a second piece of identification. Use bar books to verify primary identification. See http://www.idcheckingguide.com Social Security card With ITIN number that starts with a 9 Secondary identification has components of primary, but not considered as primary. Acceptable as a second piece of identification. Never acceptable alone to open an account. is your bank s decision based on your risk profile. Your market may dictate a more liberal approach to non resident aliens. You might just list all of the forms of identification you will accept and require two with one of them with picture, description and signature. 31

Use the ID Checking Guide to help with these types of identification. There is also an international version for Mexico Driver s Licenses and other countries. PRIMARY SHOULD INCLUDE PICTURE, DESCRIPTION AND SIGNATURE Driver s License/ non driver s identification card Passport National identification card (must show photo, name, current address, date of birth, and expiration date) Temporary Resident Card Form I-688 Employment Authorization Card Form I-688A, I-688B, I-766 Nonimmigrant Visa & Border Crossing Card Refugee Travel Document Form I-571 US Department of State Driver s Licenses VISA Consular ID Cards Mexico Driver s License (32) Canada Driver s License Primary identification Should include a picture, description of person, and signature. Should be accompanied with a second piece of identification. Use bar books to verify primary identification. See http://www.idcheckingguide.com SECONDARY HAS SOME BUT NOT ALL OF THE COMPONENTS OF PRIMARY ID Social Security card Voter s registration Birth Certificate Credit cards Civil birth certificate Foreign driver's license U.S. state identification card Foreign voter's registration card Foreign military identification card Visa U.S. Citizenship and Immigration Services (USCIS) photo identification Medical records (dependents - under 14 years old - only) School records (dependents and/or students - under 25 years old - only) Secondary identification has components of primary but not considered as primary. Acceptable as a second piece of identification. Never acceptable to open an account alone. 32

TASK #3: WORKSHEET ON DOCUMENTS OR YOU CAN JUST COPY DOCUMENTS OR BOTH SECTION TWO PRIMARY DOCUMENTS ACCEPTED BY FINANCIAL INSTITUTION Driver s License State Exp Nondriver s ID Card State Exp Passport Country Issued Exp Alien Registration Card Number Exp US Military Type Exp Expanded Primary Identification for Nonresident aliens Mexico Matricular Card National Identification Card Driver s License from their country Visas (See above notes about bank s decisions on identification for nonresident aliens) DOCUMENTS SECONDARY DOCUMENTS ACCEPTED BY FINANCIAL INSTITUTIONS Social security card Voter s registration Birth certificates Insurance cards Gun permits Company issued identification Credit Cards Birth certificates Student identification Tax return Pay stub Number if any Expiration date if any There are many types of secondary identification. You make a list that your institution can justify to examiners based on your risk. Expanded Secondary identification for Nonresident aliens ITIN Cards Any of the primary if have another primary (Mexico Matricular Cards, Visa, National Identification Cards etc) Birth certificates Voter s registration Tax return Does document verify residence or nationality? Additional Comments: If so which one? If not, how did the financial institution resolve the discrepancy? 33

TASK #3: WORKSHEET ON DOCUMENTS FOR BUSINESS AND ENTITY ACCOUNTS SECTION TWO Sole Proprietor General Partnership DOCUMENTS Assumed Name/Trade Name/Occupational License Circle One Partnership Agreement, if any Partnership Registration, if any Limited Liability Partnership Partnership Agreement Partnership Registration Limited Partnership Partnership Agreement Partnership Registration Corporation Minutes of the Board Meeting Certificate of Incorporation or Articles Stamped Filed Limited Liability Company Operating Agreement, if any Certificate of Formation or Articles stamped filed Agent, Escrow, Iolta, Public funds or other type of entity Document as required by state or bank Otherwise have to identify all signers Nonprofit organization or club Formal Trusts Charter, By-laws, minutes Otherwise have to identify all signers Trust Documents Other Note: If your bank s policy is to identify all of the signers as well as the business then you will have to do both. Also, Phase I business exemptions are also eligible for exemption under. But you will want to do some due diligence to make sure business exists and dealing with appropriate person. 34

TASK #4 NONDOCUMENTARY VERIFICATION Recognizing that some accounts are opened by telephone, by mail, and over the Internet, the final rules asked that you take that into consideration when writing your policy. You must address the situation where you will open an account for some one not appearing at your bank. Types of nondocumentary verification include: Check systems, telecheck, credit reports Customer telephone call Letter of welcome Site visit Previous bank reference Verification of employment whitepages.com google.com Secretary of State- online at www.sec.state.la.us/comm/corp/corp-filings.htm 35

POSSIBLE TASK #5 LACK OF VERIFICATION PROCEDURES Section 103.121(b) (iii) Lack of Verification The must include procedures for responding to circumstances in which the bank cannot form a reasonable belief that it knows the true identity of a customer. These procedures should describe: 1. When the bank should not open an account; 2. The terms under which a customer may use an account while the bank attempts to verify the customer s identity; 3. When the bank should close an account, after attempts to verify a customer s identity have failed; and 4. When the bank should file a Suspicious Activity Report in accordance with applicable law and regulation. 36

CLOSING AN ACCOUNT SOME SUGGESTIONS 1. Stick to your policy It is generally much easier to get information before the account is opened than after. If you stick to your policy on identification prior to opening account then it is easier on your financial institution in the long run. 2. Closing an account If you took a risk-based approach and allowed the customer a time frame to get all the information to you, and he or she failed to meet the time frame then you should notify them in writing preferable certified mail that within a stated time period the account will be closed. This varies depending on your bank and location. You probably want to notify them twice before the account is actually closed. 37

SUSPICIOUS TRANSACTIONS/MONEY LAUNDERING CHARACTERISTICS The nineteen terrorists of September 11, 2001 had financial institution accounts without valid social security numbers. All were opened with cash between $3,000 and $10,000. You will be required to file a SAR on a new account if you are unable to verify the identity of the customer and it is suspicious. If you open accounts and see suspicious behavior you should contact your bank s BSA officer. At the new accounts desk you should always be alert and watch out for: Watch list Large cash deposits $100 in cash followed by large checks Mismatched identification of names and addresses Wrong phone number exchanges for addresses Inconvenient banking locations Why are they banking at an inconvenient site? Out of state licenses Working out of state Third party checks to open accounts 38

FREQUENTLY ASKED QUESTIONS ABOUT FILING SUSPICIOUS ACTIVITY REPORTS (FINCEN DECEMBER 2000) 1. How should banks handle repeated or continuing suspicious activity on one account or by one person/customer? One of the purposes of filing SARs is to identify violations or potential violations of law to the appropriate law enforcement authorities for criminal investigation. This is accomplished by the filing of a SAR that identifies the activity of concern. Should this activity continue over a period of time, it is useful for such information to be made known to law enforcement (and the bank supervisors). As a general rule of thumb, organizations should report continuing suspicious activity with a report being filed at least every 90 days This will serve the purposes of notifying law enforcement of the continuing nature of the activity, as well as provide a reminder to the organization that it must continue to review the suspicious activity to determine if other actions may be appropriate, such as terminating its relationship with the customer or employee that is the subject of the filing. 2. Should our bank close an account with continuing suspicious activity? The closure of a customer account as the result of the identification of suspicious activity is a determination for an organization to make in light of the information available to the organization. A filing of a SAR, on its own, should not be the basis for terminating a customer relationship. Rather, a determination should be made with the knowledge of the facts and circumstances giving rise to the SAR filing, as well as other available information that could tend to impact on such a decision. It may be advisable to include the organization s counsel, as well as other senior staff, in such determinations. 3. Under what circumstances can the filing deadline for SARs be extended? The SAR rules require that a SAR be filed no later than 30 days from the date of the initial detection of the suspicious activity, unless no suspect can be identified, in which case, the time period for filing a SAR is extended to 60 days. It may be appropriate for organizations to conduct a review of the activity to determine whether a need exists to file a SAR. The fact that a review of customer activity or transactions is determined to be necessary is not necessarily indicative of the need to file a SAR, even if a reasonable review of the activity or transactions might take an extended period of time. The time to file a SAR starts when the organization, in the course of its review or on account of other factors, reaches the position in which it knows, or has reason to suspect, that the activity or transactions under review meets one or more of the definitions of suspicious activity. 39

4. To whom may we disclose information contained in SAR? Federal law (31 USC 5318(g)(2)) prohibits the notification of any person that is involved in the activity being reported on a SAR that the activity has been reported. This prohibition effectively precludes the disclosure of a SAR or the fact that a SAR has been filed. However, this prohibition does not preclude, under federal law, a disclosure in an appropriate manner of the facts that are the basis of the SAR, so long as the disclosure is not made in a way that indicates or implies that a SAR has been filed or that the information is included on a filed SAR. 40

POSSIBLE TASK #6 PLACING A HOLD ON A NEW ACCOUNT REGULATION CC 1. Applies to: Transaction accounts in the first 30 days. Your institution may or may not use the new account exception. You must look on your account disclosure to see if you use this exception. If you do, the following availability will apply for customers who have not had a transaction account with you in the last 30 days. If you do not use this exception, then you will treat items as next day, or local or non-local checks. This only applies to transaction accounts. You could always place a hold on a savings account. 2. No hold notice You do not give a hold notice on a new account because you told them in the disclosure that special rules may apply. You do not give the customer $100 cash. 41

NEW ACCOUNTS AVAILABILITY SCHEDULE Type of Item Availability CASH Next day. ELECTRONIC PAYMENTS Wires and ACH - Next day after bank receives funds. Treasury Checks, Postal Money Orders, Federal Reserve or Federal Home Loan Bank Checks, State or Local Government, Cashier s, Certified, Teller s and Traveler s Checks (May have to have special deposit slip with some items. This also includes Traveler s checks which do not appear in the other next day items.) Aggregate of funds $5000 and below are available the next day from the total of these items. Funds above $5000 are available on the 9 th business day after the bank day of deposit. $100 Cash Does not apply to new accounts. Local and Nonlocal Checks Bank s policy 42

TASK #7 RECORDKEEPING Section 103.121(b)(3) Recordkeeping The must include procedures for making and maintaining a record of all information obtained under the procedures implementing paragraph (b) of this section. (i) Required records. At a minimum, the record must include: A) All identifying information about a customer obtained under paragraphs (b)(2)(i) of this section: B) A description of any document that was relied on under paragraph (b)(2)(ii)(a) of this section noting the type of document, any identification number contained in the document, the place of issuance and, if any, the date of issuance and expiration date; C) A description of the methods and the results of any measures undertaken to verify the identity of the customer under paragraph (b)(2)(ii)(b) or (C) of this section; and D) A description of the resolution of any substantive discrepancy discovered when verifying the identifying information obtained. (ii) Retention of records. The bank must retain all the information in paragraph (b)(3)(i)(a) of this section for five years after the date the account is closed or, in the case of credit card accounts, five years after the account is closed or becomes dormant. The bank must retain the information in paragraphs (b)(3)(i)(b), (C) or (D) of this section for five years after the record is made. 31 C.F.R. 103.121(b)(3)(i) Required records 1. Would it be acceptable to retain a description of the non-documentary customer verification method used (such as a consumer credit report or an inquiry to a fraud detection system) in a general policy or procedure instead of recording the fact that a particular method was used on each individual customer's record? Yes, provided that the record cross-references the specific provision(s) of the risk-based procedures contained in the bank s used to verify the customer s identity. (January 2004) 2. Can a bank keep copies of documents provided to verify a customer s identity, in addition to the description required under 31 C.F.R. 103.121(b)(3)(i)(B), even if it is not required to do so? Yes, a bank may keep copies of identifying documents that it uses to verify a customer s identity. A bank s verification procedures should be risk-based and, in certain situations, keeping copies of identifying documents may be warranted. In addition, a bank may have procedures to keep copies of documents for other purposes, for example, to facilitate investigating potential fraud. (These documents should be retained in accordance with the general recordkeeping requirements in 31 C.F.R. 103.38.) Nonetheless, a bank should be mindful that it must not improperly use any document containing a picture of an individual, such as a driver s license, in connection with any aspect of a credit transaction. (January 2004) 43

31 C.F.R. 103.121(b)(3)(ii) Retention of records 1. Does the original information obtained during account opening have to be retained or can the bank satisfy the recordkeeping requirement by just keeping updated information about the customer, i.e., the customer s current address? The rule requires that a bank retain the identifying information obtained about the customer at the time of account opening for five years after the date the account is closed or, in the case of credit card accounts, five years after the account is closed or becomes dormant. 31 C.F.R. 103.121(b)(3)(ii). Updated information serves valuable, but different, purposes. (January 2004) 2. If the bank requires a customer to provide more identifying information than the minimum during the account opening process, does it have to keep this information for more than five years? The bank must keep for five years after the account is closed, or in the case of credit card accounts, five years after the account is closed or becomes dormant, all identifying information it gathers about the customer to satisfy the requirements of 103.121(b)(2)(i) of the rule. 31 C.F.R. 103.121(b)(3)(ii). This would include any identifying information, the bank will use, at the time the account is opened, to establish a reasonable belief it knows the true identity of the customer. So, for example, if the bank obtains other identifying information at account opening in addition to the minimal information required, such as the customer's phone number, then the bank must keep that information. (January 2004) 3. How does the record retention period apply to a customer who simultaneously opens multiple accounts in the bank? If several accounts are opened for a customer simultaneously, all identifying information about a customer obtained under 31 C.F.R. 103.121(b)(2)(i) must be retained for five years after the last account is closed or, in the case of credit card accounts, five years after the last account is closed or becomes dormant. All remaining records must be kept for five years after the records are made. (January 2004) 4. How does the record retention period apply to a situation where a bank sells a loan but retains the servicing rights to the loan? When a bank sells a loan, the account is closed under the record retention provision (31 C.F.R. 103.121(b)(3)(ii)), regardless of whether the bank retains the servicing rights to the loan. Thus, a bank should keep the records of identifying information about a customer for five years after the date that the loan is sold, as required by 31 C.F.R. 103.121(b)(3)(i)(A). Any other record required by 31 C.F.R. 103.121(b)(3)(i) must be kept for five years after the record is made. (April 2005) 44

TASK #8 COMPARISON WITH GOVERNMENT LISTS Section 103.121(b)(4) Comparison with government lists. The must include procedures for determining whether the customer appears on any list of known or suspected terrorists or terrorist organizations issued by any Federal government agency and designated as such by Treasury in consultation with the Federal functional regulators. The procedures must require the bank to make such a determination within a reasonable period of time after the account is opened, or earlier, if required by another Federal law or regulation or Federal directive issued in connection with the applicable list. The procedures must also require the bank to follow all Federal directives issued in connection with such lists. 31 C.F.R. 103.121(b)(4) -- Section 326 List 1. Has a list of known or suspected terrorists or terrorist organizations been designated for purposes of the rule? No such list has been designated to date. Banks will be contacted by their functional regulators when a list is issued. As of the time of publication, lists published by OFAC have not been designated as lists for purposes of the rule. Of course, banks are separately obligated to check these lists in accordance with OFAC s regulations. (January 2004) 45

TASKS #4-8 AND 10 SECTION THREE Nondocument verification DOCUMENTS Check systems, telecheck, credit reports Customer telephone call Letter of welcome Site visit Previous bank reference Verification of employment whitepages.com google.com Secretary of State- online at www.sos.state.tx.us Regulation CC Hold Yes/No Circle One OFAC Check Yes/No Circle One If match, false positive or complete match Results: Resolve conflict in documents: Additional Comments: 46

TASK #9: AFTER GATHERING THE INFORMATION ASSIGN RISK Customer Identification Programs () risk is related to many items. You will probably consider accounts to be high risk if they were: Not Opened in person Opened by non resident aliens Opened without all documents Opened without proper identification Opened for a minor (What is your bank s policy on joint accounts for identification? 47

HIGH INTENSITY DRUG TRAFFICKING AREAS HIDTA Headquarters Southwest Border Regions http://www.whitehousedrugpolicy.gov/hidta/index.html 48

PUBLICATION 519: U.S. TAX GUIDE FOR ALIENS 2005 RETURNS Note to participants: You may wish to print all of Publication 519 With these materials. It may prove useful to you. Figure 1-A. Nonresident Alien or Resident Alien? 49

YOUR CUSTOMER S RISK RATING SAMPLE FOR PERSONAL ACCOUNTS CUSTOMER NAME: /CDD New (20) Existing (10) RISK (HIGH, MEDIUM OR LOW) LOW 10 POINTS MEDIUM 20 POINTS HIGH RISK 30 POINTS US Person or resident alien (10) Non resident alien (30) What nationality if nonresident alien? Is customer in a high risk geographic area? HIDTA or HIFCA Opened in person all parties present (10) Opened by mail (20) Opened on internet (3) Opened with: Cash (10) Cashier s Check (30) Payroll check (10) Other monetary instruments (2) TOTAL SCORE 50

TASK #10 CHECK OFFICE OF FOREIGN ASSETS CONTROL (OFAC) 1. Overview The Office of Foreign Assets Control (OFAC) is a division of the U.S. Treasury. OFAC s purpose is to enforce sanctions against foreign countries, their agents, terrorists or other threats against the United States national security. It is not just the countries but also individuals called Specially Designated Nationals also called a Blocked Person. We are required to block or freeze any accounts for these individuals or countries within 10 days from the occurrence of the activity. Your institution can be fined and penalized for failure to comply with OFAC. 2. The List The OFAC list is updated frequently and should be kept up to date at your financial institution. Before we open an account, it is a good idea to check the list to make sure that the person or entity opening the account is not on the list. That way we can prevent subsequent action of blocking and freezing assets. Your financial institution should have established procedures to continually audit and check for compliance with OFAC guidelines. Since the list is updated often, an account that you opened up last year may now be on this list. This is not something that you can prevent at the new accounts desk. Website for OFAC list: www.treasury.gov/offices/enforcement/ofac/sdn OFAC Compliance Web Site www.ofaccompliance.com Fax on Demand 202-622-0077 Compliance Hotline 202-622-2490 51

OFAC FREQUENTLY ASKED QUESTIONS AND ANSWERS OFAC - Frequently Asked Questions and Answers Section 1.01 Section 1.02 General Questions What is OFAC and what does it do? The Office of Foreign Assets Control administers and enforces economic sanctions programs primarily against countries and groups of individuals, such as terrorists and narcotics traffickers. The sanctions can be either comprehensive or selective, using the blocking of assets and trade restrictions to accomplish foreign policy and national security goals. [09-10-02] How long has OFAC been around? The Treasury Department has a long history of dealing with sanctions. Dating back prior to the War of 1812, Secretary of the Treasury Gallatin administered sanctions imposed against Great Britain for the harassment of American sailors. During the Civil War, Congress approved a law which prohibited transactions with the Confederacy, called for the forfeiture of goods involved in such transactions, and provided a licensing regime under rules and regulations administered by Treasury. OFAC is the successor to the Office of Foreign Funds Control (the ``FFC''), which was established at the advent of World War II following the German invasion of Norway in 1940. The FFC program was administered by the Secretary of the Treasury throughout the war. The FFC's initial purpose was to prevent Nazi use of the occupied countries' holdings of foreign exchange and securities and to prevent forced repatriation of funds belonging to nationals of those countries. These controls were later extended to protect assets of other invaded countries. After the United States formally entered World War II, the FFC played a leading role in economic warfare against the Axis powers by blocking enemy assets and prohibiting foreign trade and financial transactions. OFAC itself was formally created in December 1950, following the entry of China into the Korean War, when President Truman declared a national emergency and blocked all Chinese and North Korean assets subject to U.S. jurisdiction. [05-02-06] What does one mean by the term "prohibited transactions"? Prohibited transactions are trade or financial transactions and other dealings in which U.S. persons may not engage unless authorized by OFAC or expressly exempted by statute. Because each program is based on different foreign policy and national security goals, prohibitions may vary between programs.[06-16-06] 52

Are there exceptions to the prohibitions? Yes. OFAC regulations often provide general licenses authorizing the performance of certain categories of transactions. OFAC also issues specific licenses on a case-by-case basis under certain limited situations and conditions. Guidance on how to request a specific license is found below and at 31 C.F.R. 501.801. [06-16-06] When should I call OFAC s compliance hotline? Only after you ve taken the following due diligence steps. If you are calling about a wire transfer or other live transaction: 1. Is the hit or match against OFAC s SDN list or targeted countries, or is it hitting for some other reason (i.e., Control List or PEP, CIA, Non-Cooperative Countries and Territories, Canadian Consolidated List (OSFI), World Bank Debarred Parties, Blocked Officials File, or government official of a designated country ), or can you not tell what the hit is? If it s hitting against OFAC s SDN list or targeted countries, continue to 2 below. If it s hitting for some other reason, you should contact the keeper of whichever other list the match is hitting against. For questions about: The Denied Persons List and the Entities List, please contact the Bureau of Industry and Security at the U.S. Department of Commerce at 202-482-4811. The FBI s Most Wanted List or any other FBI-issued watch list, please contact the Federal Bureau of Investigation (http://www.fbi.gov/contact/fo/fo.htm). The Debarred Parties list, please contact the Office of Defense Trade Controls at the U.S. Department of State, 202-663-2700. The Bank Secrecy Act and the USA PATRIOT Act, please contact the Financial Crimes Enforcement Network (FinCEN), 1-800-949-2732. If you are unsure whom to contact, please contact your interdict software provider which told you there was a hit. If you can t tell what the hit is, you should contact your interdict software provider which told you there was a hit. 2. Now that you ve established that the hit is against OFAC s SDN list or targeted countries, you must evaluate the quality of the hit. Compare the name in your transactions with the name on the SDN list. Is the name in your transaction an individual while the name on the SDN list is a vessel, organization or company (or vice-versa)? If yes, you do not have a valid match.* If no, please continue to 3 below. 3. How much of the SDN s name is matching against the name in your transaction? Is just one of two or more names matching (i.e., just the last name)? If yes, you do not have a valid match.* 53

If no, please continue to 4 below. 4. Compare the complete SDN entry with all of the information you have on the matching name in your transaction. An SDN entry often will have, for example, a full name, address, nationality, passport, tax ID or cedula number, place of birth, date of birth, former names and aliases. Are you missing a lot of this information for the name in your transaction? If yes, go back and get more information and then compare your complete information against the SDN entry. If no, please continue to 5 below. 5. Are there a number of similarities or exact matches? If yes, please call the hotline at 1-800-540-6322. If no, you do not have a valid match.* If you are calling about an account: 1. Is the hit or match against OFAC s SDN list or targeted countries, or is it hitting for some other reason (i.e., Control List or PEP, CIA, Non-Cooperative Countries and Territories, Canadian Consolidated List (OSFI), World Bank Debarred Parties, or government official of a designated country ), or can you not tell what the hit is? If it s hitting against OFAC s SDN list or targeted countries, continue to 2 below. If it s hitting for some other reason, you should contact the keeper of whichever other list the match is hitting against. For questions about: The Denied Persons List and the Entities List, please contact the Bureau of Industry and Security at the U.S. Department of Commerce at 202-482-4811. The FBI s Most Wanted List or any other FBI-issued watch list, please contact the Federal Bureau of Investigation (http://www.fbi.gov/contact/fo/fo.htm). The Debarred Parties list, please contact the Office of Defense Trade Controls at the U.S. Department of State, 202-663-2700. The Bank Secrecy Act and the USA PATRIOT Act, please contact the Financial Crimes Enforcement Network (FinCEN), 1-800-949-2732. If you are unsure whom to contact, you should contact your interdict software provider which told you there was a hit. If you can t tell what the hit is, you should contact your interdict software provider which told you there was a hit. 2. Now that you ve established that the hit is against OFAC s SDN list or targeted countries, you must evaluate the quality of the hit. Compare the name of your accountholder with the name on the SDN list. Is the name of your accountholder an individual while the name on the SDN list is a vessel, organization or company (or vice-versa)? If yes, you do not have a valid match.* If no, please continue to 3 below. 54

3. How much of the SDN s name is matching against the name of your accountholder? Is just one of two or more names matching (i.e., just the last name)? If yes, you do not have a valid match.* If no, please continue to 4 below. 4. Compare the complete SDN entry with all of the information you have on the matching name of your accountholder. An SDN entry often will have, for example, a full name, address, nationality, passport, tax ID or cedula number, place of birth, date of birth, former names and aliases. Are you missing a lot of this information for the name of your accountholder? If yes, go back and get more information and then compare your complete information against the SDN entry. If no, please continue to 5 below. 5. Are there a number of similarities or exact matches? If yes, please call the hotline at 1-800-540-6322. If no, you do not have a valid match.* * If you have reason to know or believe that processing this transfer or operating this account would violate any of the Regulations, you must call the hotline and explain this knowledge or belief. [02-12-03] What do you mean by "blocking?" Another word for it is "freezing." It is simply a way of controlling targeted property. Title to the blocked property remains with the target, but the exercise of powers and privileges normally associated with ownership is prohibited without authorization from OFAC. Blocking immediately imposes an across-the-board prohibition against transfers or dealings of any kind with regard to the property. [09-10-02] What countries do I need to worry about in terms of U.S. sanctions? OFAC administers a number of U.S. economic sanctions and embargoes that target geographic regions and governments (such as Cuba, Cote d'ivoire, Iran, Iraq, Libya, North Korea, Sudan, Liberia, Zimbabwe, Sierra Leone, the UNITA faction in Angola, Syria and Burma [Myanmar]) as well as other programs targeting individuals or entities that could be anywhere, currently, programs relating to foreign narcotics traffickers, foreign terrorists, WMD proliferators, persons in the Western Balkans (included within these are, e.g., Foreign Terrorist Organizations, designated foreign persons who have engaged in activities related to the proliferation of weapons of mass destruction, and designated foreign persons associated with Slobodan Milosevic or who threaten international stabilization efforts in the Western Balkans). In addition to targeted countries, it is very important to note that OFAC publishes a list of Specially Designated Nationals and Blocked Persons ("SDN list") which includes over 3,500 names of companies and individuals who are connected with the sanctions targets and are located throughout the world (with addresses listed in 112 countries as of 09/2002). A number of the named individuals and 55

entities are known to move from country to country and may end up in locations where they would be least expected. U.S. persons are prohibited from dealing with SDNs wherever they are located and all SDN assets are blocked. Because OFAC's programs are dynamic and constantly changing, it is very important to check OFAC's website on a regular basis to ensure that your SDN list is current and you have complete information regarding current restrictions affecting countries and parties with which you plan to do business. [02-10-06] Who must comply with OFAC regulations? All U.S. persons must comply with OFAC regulations, including all U.S. citizens and permanent resident aliens regardless of where they are located, all persons and entities within the United States, all U.S. incorporated entities and their foreign branches. In the cases of certain programs, such as those regarding Cuba and North Korea, all foreign subsidiaries owned or controlled by U.S. companies also must comply. Certain programs also require foreign persons in possession of U.S. origin goods to comply. [09-10-02] How much are the fines for violating these regulations? The fines for violations can be substantial. Depending on the program, criminal penalties can include fines ranging from $50,000 to $10,000,000 and imprisonment ranging from 10 to 30 years for willful violations. Depending on the program, civil penalties range from $11,000 to $1,000,000 for each violation. [09-10-02] What is an SDN? As part of its enforcement efforts, OFAC publishes a list of individuals and companies owned or controlled by, or acting for or on behalf of, targeted countries. It also lists individuals, groups, and entities, such as terrorists and narcotics traffickers designated under programs that are not country-specific. Collectively, such individuals and companies are called "Specially Designated Nationals" or "SDNs." Their assets are blocked and U.S. persons are generally prohibited from dealing with them. [09-10-02] How do I get a copy of this list? The best way to get the list is from OFAC's website. The list is disseminated in a number of different formats, including fixed field/delimited files that can be integrated into databases. [09-10-02] How often is the SDN list updated? The SDN list is frequently updated. There is no predetermined timetable, but rather names are added or removed as necessary and appropriate. [09-10-02] How do I know what specific changes have been made to OFAC's SDN list? All changes for the current calendar year are cumulatively available in a.pdf file and in an ASCII version. Cumulative changes for prior years back to 1994 are also available in ASCII 56

format by following this link. The same link will take you to a *.PDF version of the file for calendar year 2001. The calendar year 2002 *.PDF file and future calendar year *.PDF files will be archived at that link. [09-10-02] Does OFAC maintain or can it create a country-by-country list of SDNs? OFAC has long maintained such a list. The file is available for downloading by clicking on the DOS or Windows Delimited SDN List links on OFAC's Website. The file is contained within those self-extracting archives and is called ctry_list.txt. It is important to understand that many SDN individuals and entities may operate in countries other than those in which they are based. The relevant regulations prohibit transactions with and/or block the property of SDNs wherever they are located. [09-10-02] What do I do if I have a match to the SDN list? If you have checked a name manually or by using software and find a match, you should do a little more research. Is it an exact name match, or very close? Is your customer located in the same general area as the SDN? If not, it may be a "false hit." If there are many similarities, contact OFAC's "hotline" at 1-800-540-6322 for verification. If your "hit" concerns an inprocess wire transfer, you may prefer to e-mail your question to OFAC. Unless a transaction involves an exact match, it is recommended that you contact OFAC Compliance before actually blocking assets. [09-10-02] What is the Control list? Who do I call about the Control list? What is the difference between the Control list and OFAC's SDN list? The Control List was developed by the law enforcement community in response to the events of September 11. It is separate from the OFAC's SDN list and is not disseminated by OFAC. If you have received a copy of this list, you should follow the instructions received with it. [09-10-02] What do I do if a person tries to open an account and the person's name is on OFAC's SDN list? Do I open the account and then block the funds? A U.S. bank cannot open an account for a person named on the SDN list. This is a prohibited service. However, you should pay careful attention to be sure the person trying to open the account is the same person as the one named on OFAC's list. In many cases you may get a "false positive," where the name is similar to a target's name, but the rest of the information provided by the applicant does not match the descriptor information on OFAC's SDN list. If the bank does come into the possession or control of any property in which a blocked person has an interest, it is obligated to block that property. In other words, if you receive an application to open an account from a person who matches the information on the SDN list, together with an opening deposit, you are obligated to block the funds. The same is true for other banking transactions. If, for example, a customer asks if he or she is allowed to send money to a relative's account with Bank of Khartoum in Sudan, the bank can say "no, that's illegal." If, on the other hand, a bank receives instructions from its customer to debit his or her account and send the funds to Bank of 57

Khartoum, the bank must act on the instructions by blocking the funds which contain a future interest of the Sudanese SDN bank. You might think of the analogy of a bouncing ball. Once the ball starts moving, you must stop it if it comes into your possession. 58

TASK #11 CUSTOMER NOTICE FOR Section 103.121(b)(5)(i) Customer notice The must include procedures for providing bank customers with adequate notice that the bank is requesting information to verify their identities. (ii) Adequate notice. Notice is adequate if the bank generally describes the identification requirements of this section and provides the notice in a manner reasonably designed to ensure that a customer is able to view the notice, or is otherwise given notice, before opening an account. For example, depending upon the manner in which the account is opened, a bank may post a notice in the lobby or on its website, include the notice on its account applications, or use any other form of written or oral notice. (iii) Sample notice. If appropriate, a bank may use the following sample language to provide notice to its customers: IMPORTANT INFORMATION ABOUT PROCEDURES FOR OPENING A NEW ACCOUNT To help the government fight the funding of terrorism and money laundering activities, Federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens an account. What this means for you: When you open an account, we will ask for your name, address, date of birth, and other information that will allow us to identify you. We may also ask to see your driver s license or other identifying documents. 31 C.F.R. 103.121(b)(5) -- Customer notice 1. Does a bank have to provide notice to all owners of a joint account? Yes, notice must be provided to all owners of a joint account. In addition, notice must be provided in a manner reasonably designed to ensure that a customer is able to view the notice, or is otherwise given notice, before opening an account. 31 C.F.R. 103.121(b)(5)(ii). The Agencies agree that a bank may satisfy this requirement by directly providing the notice to any one accountholder of a joint account for delivery to the other owners of the account. Similarly, the bank may open a joint account using information about each of the accountholders obtained from one accountholder, acting on behalf of the other joint accountholders. (January 2004) 2. How should a bank provide notice to its customer when it engages in indirect lending through a third party such as a mortgage broker or car dealer? When a mortgage broker or car dealer is acting as the bank's agent in connection with a loan, the bank may delegate to its agent the obligation to perform the requirements of the bank s rule. In contrast to the reliance provision in the rule, the bank is ultimately responsible for its agent s compliance with the rule. Depending upon the manner in which the account is opened, the agent can provide notice to the bank s customer, for example, by posting a sign, printing the notice on the loan application given to the customer, orally providing the notice, or by providing the notice in any manner that is reasonably designed to ensure that the customer is given notice before opening an account. (January 2004) 59

POSSIBLE TASK #12 RELIANCE ON ANOTHER FINANCIAL INSTITUTION Section 103.121(b)(6) Reliance on another financial institution. The may include procedures specifying when a bank will rely on the performance by another financial institution (including an affiliate) of any procedures of the bank s, with respect to any customer of the bank that is opening, or has opened, an account or has established a similar formal banking or business relationship with the other financial institution to provide or engage in services, dealings, or other financial transactions, provided that: (i) Such reliance is reasonable under the circumstances; (ii) The other financial institution is subject to a rule implementing 31 U.S.C.5318(h) and is regulated by a Federal functional regulator; and (iii) The other financial institution enters into a contract requiring it to certify annually to the bank that is has implemented its anti-money laundering program, and that it will perform (or its agent will perform) the specified requirements of the bank s. 31 C.F.R. 103.121(b)(6) -- Reliance 1. Where a bank is entitled to rely on another financial institution to perform its, whose must the relied-upon financial institution implement? The reliance provision does not impose on the other financial institution the obligation to duplicate the procedures in the bank s. The reliance provision permits a bank to rely on another financial institution to perform any of the procedures of the bank s, meaning, any of the elements that the rule requires to be in a bank s : (1) identity verification procedures, which include collecting the required information from customers and using some or all of that information to verify the customers identities; (2) keeping records related to the ; (3) determining whether a customer appears on a designated list of known or suspected terrorists or terrorist organizations; and (4) providing customers with adequate notice that information is being requested to verify their identities. Note that a bank can only use the reliance provision when the other financial institution is regulated by a Federal functional regulator and is subject to a general BSA compliance program rule, they share the customer, the bank can show its reliance upon the other financial institution s performance of an element of the bank s was reasonable under the circumstances, and the requisite contract is signed and certifications provided. (January 2004) 2. When a longstanding customer of another financial institution (including an affiliate) opens a new account at the bank, can a bank rely on the other financial institution s verification of the identity of the customer performed before a procedure was required? A bank that is subject to the rule may rely on another financial institution s verification of the identity of the customer if the requirements of the reliance provision are satisfied. The bank would have to be able to demonstrate that such reliance upon the other financial institution s verification of the identity of the 60

customer is reasonable under the circumstances. For example, the bank could do so by reviewing the relied-upon institution s procedures to ensure that they were adequate although the institution was not yet subject to a rule when it verified the customer s identity. In addition, even when a bank is relying on the verification of identity performed by another institution, the bank would continue to be responsible for complying with all remaining requirements of the rule, namely, the requirement that it keep records, provide customer notice, and as soon as a section 326 list has been designated, check the list when a new account is opened. (January 2004) 61

BSA EXAM ISSUES ON CUSTOMER DUE DILIGENCE OBJECTIVE Assess the appropriateness and comprehensiveness of the bank s customer due diligence (CDD) policies, procedures, and processes for obtaining customer information and assess the value of this information in detecting, monitoring, and reporting suspicious activity. OVERVIEW The cornerstone of a strong BSA/AML compliance program is the adoption and implementation of comprehensive CDD policies, procedures, and processes for all customers, particularly those that present a high risk for money laundering and terrorist financing. The objective of CDD procedures should be to enable the bank to predict with relative certainty the types of transactions in which a customer is likely to engage. These procedures assist the bank in determining when transactions are potentially suspicious. The concept of CDD begins with verifying the customer s identity and assessing the risks associated with that customer. Procedures should also include enhanced CDD for high risk customers and ongoing due diligence of the customer base. Effective CDD policies, procedures, and processes provide the critical framework that enables the bank to comply with regulatory requirements and to report suspicious activity. CDD policies, procedures, and processes are critical to the bank because they can aid in: Detecting and reporting unusual or suspicious transactions that potentially expose the bank to financial loss, increased expenses, or reputational risk. Avoiding criminal exposure from persons who use or attempt to use the bank s products and services for illicit purposes. Adhering to safe and sound banking practices. CUSTOMER DUE DILIGENCE GUIDANCE BSA/AML policies, procedures, and processes should include CDD guidelines that: Are commensurate with the bank s BSA/AML risk profile, paying particular attention to high-risk customers. Contain a clear statement of management s overall expectations and establish specific staff responsibilities, including who is responsible for reviewing or approving changes to a customer s risk rating or profile, as applicable. Ensure that the bank possesses sufficient customer information to implement an effective suspicious activity monitoring system. Provide guidance for documenting analysis associated with the due diligence process, including guidance for resolving issues when insufficient or inaccurate information is obtained. Ensure the bank maintains current customer information. CUSTOMER RISK Management should have a thorough understanding of the money laundering or terrorist financing risks of the bank s customer base. Under this approach, the bank will obtain information at account opening sufficient to develop an understanding of normal and expected activity for the customer s occupation or business operations. Much of the CDD information can be confirmed through an information-reporting 62

agency, banking references (for larger accounts), correspondence and telephone conversations with the customer, and visits to the customer s place of business. Additional steps may include obtaining thirdparty references or researching public information (e.g., on the Internet or commercial databases). CDD procedures should include periodic monitoring of the customer relationship to determine whether there are substantive changes to the original CDD information (e.g., change in employment or business operations). ENHANCED DUE DILIGENCE FOR HIGH-RISK CUSTOMERS Customers that pose high money laundering or terrorist financing risks present increased exposure to banks and due diligence policies, procedures, and processes should be enhanced as a result. Enhanced due diligence for high-risk customers is especially critical in understanding their anticipated transactions and implementing a suspicious activity monitoring system that reduces the bank s reputation, compliance, and transaction risks. High-risk customers and their transactions should be reviewed more closely at account opening and more frequently throughout the term of their relationship with the bank. Guidance to identify high-risk customers may be found in the core overview section Scoping and Planning. The bank may determine that a customer poses a high risk because of the customer s business activity, ownership structure, anticipated or actual volume and types of transactions, including those transactions involving high-risk jurisdictions. If so, the bank should consider obtaining, both at account opening and throughout the relationship, the following information on the customer: Purpose of the account. Source of funds and wealth. Beneficial owners of the accounts, if applicable. Customer s (or beneficial owner s) occupation or type of business. Financial statements. Banking references. Domicile (where the business is incorporated). Proximity of the customer s residence, place of employment, or place of business to the bank. Description of the customer s primary trade area and whether international transactions are expected to be routine. Description of the business operations, the anticipated volume of currency and total sales, and a list of major customers and suppliers. Explanations for changes in account activity. 63

TASK #13 SAMPLE PERSONAL CUSTOMER PROFILE WORKSHEETS SECTION FOUR Type of customer: New Existing customer adding new service Type of person: US Person Non US person Location of customer: HIDT Parish/County Non HIDT Parish/County Do you have any deposits come in automatically? Social Security Pay Roll Investment Other Do you plan to use the following: Internet banking ATM Other branches? If so where Wire services? If so where Lending Over Draft Protection Safe Deposit Boxes QUESTIONS Account opening method: In person all parties present In person, less than all parties present Mail Telephone Email, website Type of deposit: Cash On us transfer or check Payroll check Government Check What brought you to our bank? Product Relationship with banker Location Dissatisfied with current bank Other Do you use automatic withdrawals? Utilities House note Other Cashier s check Wire Foreign funds Do you know how many deposits you will make a month? 1-5 6-10 11 or more Do you know how many checks or withdrawals you plan to make a month? 1-5 6-10 11 or more 64

TASK #14 SAMPLE BUSINESS CUSTOMER PROFILE WORKSHEETS SECTION FOUR Type of customer: New Existing customer adding new service Type of person: US Person Non US person Type of deposit: Cash On us transfer or check Payroll check Location of customer: HIDT Parish Non HIDT Parish Government Check Cashier s check Wire Foreign Fund What brought you to our bank? Product Relationship with banker Location Dissatisfied with current bank Other What is the purpose of the account? Pay Roll Operating Account Other Do you have any deposits come in automatically? YES NO Do you plan to use the following: Internet banking ATM, Debit Cards Other branches? If so where Wire services? If so where Lending Safe Deposit Boxes ACH Lockbox Do you have any cash needs for our branch? YES If yes, how much. QUESTIONS Account opening method: In person all parties present In person, less than all parties present Mail Telephone Email, website Type of business: Money Service Business (check cashing, wires, issuer or redeemer of cashiers checks, etc--fill out MSB questionnaire) Buying or selling motor vehicles of any kind, vessels, aircraft, farm equipment, or mobile homes Practicing law Accounting Practicing medicine Auctioning goods Chartering or operating ships, buses, or aircraft Gaming of any kind (other than licensed pari-mutuel betting at race tracks) Real estate brokerage Pawn brokerage Title insurance and real estate closing Trade union activities Other How close is your office? 1-5 miles 6-10 miles 11+ miles Do you use automatic withdrawals? Sweep Accounts Utilities Other Do you know how many deposits you will make a month? 1-5 6-10 11 or more Do you know how many checks or withdrawals you plan to make a month? 1-5 6-10 11 or more 65

TASK #15: EXAMPLES OF HIGH RISK CUSTOMERS FROM BSA EXAM MANUAL YOU WILL NEED ENHANCED DUE DILIGENCE QUESTIONS FOR THIS GROUP TASK #15 ASK MORE QUESTIONS FOR ENHANCED DUE DILIGENCE IF YOU BANK ANY OF THE FOLLOWING. LOOK AT WHAT THE EXAMINERS WILL BE LOOKING FOR FOR EACH OF THESE GROUPS OF CUSTOMERS! Purpose of the account. Source of funds and wealth. Beneficial owners of the accounts, if applicable. Customer s (or beneficial owner s) occupation or type of business. Financial statements. Banking references. Domicile (where the business is incorporated). Proximity of the customer s residence, place of employment, or place of business to the bank. Description of the customer s primary trade area and whether international transactions are expected to be routine. Description of the business operations, the anticipated volume of currency and total sales, and a list of major customers and suppliers. Explanations for changes in account activity. HIGH RISK ON THE BSA EXAM Private Banking Trust and Asset Management Services Nonresident Aliens and Foreign Individuals Politically Exposed Persons Embassy and Foreign Consulate Accounts Non-Bank Financial Institutions Professional Service Providers Non-Governmental Organizations and Charities Business Entities (Domestic and Foreign) Cash-Intensive Businesses 66

EXAMPLE: NON RESIDENT ALIENS ENHANCED DUE DILIGENCE NON RESIDENT ALIENS ENHANCED DUE DILIGENCE TASK # 15 Opening Accounts for Non Resident Aliens Job #1 Resident or non resident alien If the customer is a resident alien, then he or she is treated as a US Person and can sign a W-9 Job #2 Purpose NRA is opening account: Asset preservation, business expansion and investments. Job #3 Identify the accountholder Job #4 Identify the sources of the funds and the wealth Job #5 Identify the country and determine the risk with that particular country Job #6 Is the individual a Politically Exposed Person (PEP) See BSA Exam manual for Enhanced Due Diligence Job #7 Determine the kinds of products and services the nonresident alien plans to use and evaluate for risk. 67

BSA EXAM MANUAL: EXPANDED EXAMINATION OVERVIEW AND PROCEDURES FOR PERSONS AND ENTITIES NONRESIDENT ALIENS AND FOREIGN INDIVIDUALS OVERVIEW EXPANDED EXAMINATION OVERVIEW AND PROCEDURES FOR PERSONS AND ENTITIES Nonresident Aliens and Foreign Individuals Overview Objective. Assess the adequacy of the bank s systems to manage the risks associated with transactions involving accounts held by nonresident aliens (NRAs) and foreign individuals, and management s ability to implement effective due diligence, monitoring, and reporting systems. Foreign individuals maintaining relationships with U.S. banks can be divided into two categories: resident aliens and nonresident aliens. For definitional purposes, an NRA is a non- U.S. citizen who: (i) is not a lawful permanent resident of the United States during the calendar year and who does not meet the substantial presence test, 1 or (ii) has not been issued an alien registration receipt card, also known as a green card. The Internal Revenue Service determines the tax liabilities of a foreign person and officially defines the person as a resident or nonresident. Although NRAs are not permanent residents, they may have a legitimate need to establish an account relationship with a U.S. bank. NRAs use bank products and services for asset preservation (e.g., mitigating losses due to exchange rates), business expansion, and investments. The amount of NRA deposits in the U.S. banking system has been estimated to range from hundreds of billions of dollars to about $1 trillion. Even at the low end of the range, the magnitude is substantial, both in terms of the U.S. banking system and the economy. Risk Factors Banks may find it more difficult to verify and authenticate an NRA accountholder s identification, source of funds, and source of wealth, which may result in BSA/AML risks. The NRA s home country may also heighten the account risk, depending on the secrecy laws of that country. Since the NRA is expected to reside outside of the United States, funds transfers or the use of foreign automated teller machines (ATMs) may be more frequent. The BSA/AML risk may be further heightened if the NRA is a politically exposed person (PEP). Refer to the expanded examination procedures, Politically Exposed Persons, for further information. Risk Mitigation 1 A foreign national is a resident alien if the individual is physically present in the United States for at least 31 days in the current calendar year and present 183 days or more based on counting: all days present during the current year, plus 1/3 of the days present in the preceding year, plus 1/6 of the days present in the second preceding year. Certain days of presence are disregarded, such as (i) days spent in the United States for a medical condition that developed while the foreign national was present in the United States and unable to leave, (ii) days regular commuters spend traveling to or from Canada or Mexico, (iii) a day of less than 24 hours spent while in transit between two locations outside the United States., and (iv) days when the foreign national was an exempt individual. The individual is considered a resident alien for federal income and employment tax purposes from the first day of physical presence in the United States in the year that the test is satisfied. Refer to the Internal Revenue Service web site: www.irs.gov. 68

Banks should establish policies, procedures, and processes that provide for sound due diligence and verification practices, adequate risk assessment of NRA accounts, and ongoing monitoring and reporting of unusual or suspicious activities. The following factors are to be considered when determining the risk level of an NRA account: The accountholder s home country. The types of products and services used. Forms of identification. The source of wealth and funds. Unusual account activity. NRA customers may request W-8 status for U.S. tax withholding. In such cases, the NRA customer completes a W-8 form, which attests to the customer s foreign and U.S. tax-exempt status. While it is an Internal Revenue Service (IRS) form, a W-8 is not sent to the IRS, but is maintained on file at the bank to support the lack of any tax withholding from earnings. 2 The bank s Customer Identification Program () should detail the identification requirements for opening an account for an NRA. The program should include the use of documentary and nondocumentary methods to verify a customer. In addition, the Patriot Act amended the BSA to require special due diligence for private banking accounts for non-u.s. persons, including those held for PEPs or senior foreign political figures. 2 Additional information can be found at www.irs.gov/formspubs. See also IRS Bulletin 515 Withholding of Tax on Nonresident Aliens and Foreign Entities. 69

SAMPLE PERSONAL CUSTOMER IDENTIFICATION WORKSHEET CUSTOMER IDENTIFICATION WORKSHEET Non Resident Alien Account SECTION FIVE INFORMATION New Customer Existing Customer US Person (See US Person Worksheet) Non US Person (Attach W-8) Business Account (Complete Business Worksheet) Personal Account Name (As it appears on Primary Identification) Nationality Residential/Street Address SSN/ITIN Date of Birth Home phone Work phone Employment/Student Contact Individual Documentary Verification Type of Identification: Select Two and one form of identification must have picture, description and signature Passport Temporary Resident Card Form I-688 Employment Authorization Card Form I-688A, I-688B, I-766 Nonimmigrant Visa & Border Crossing Card Refugee Travel Document Form I-571 US Department of State Driver s Licenses VISA Consular ID Cards Social Security Card Mexico Driver s License (32) Canada Card Expiration Nationality Number Card Expiration Nationality Number Non documentary Verification Type of None documentary Verification Letter of Welcome Third party verification: Type Check Systems, Credit report OFAC Other Resolution of Discrepancies 70

Type of customer: New Existing customer adding new service Type of person: US Person Non US person Source of funds: Are the funds coming from home? Where are the funds coming from to open this account? Bank where the funds are currently located Do you plan to use the following: Internet banking ATM Other branches? If so where Wire services? If so where Lending Over Draft Protection Safe Deposit Boxes Risk Assessment: Account opening method: In person all parties present In person, less than all parties present Mail Telephone Email, website Purpose of the account: Safety of US Banking System Family in the US Travel Frequently in the US Type of deposit: Cash On us transfer or check Payroll check Government Check Cashier s check Wire Foreign funds Do you know how many deposits you will make a month? 1-5 6-10 11 or more Location of customer: Nationality Do you use automatic withdrawals? Utilities House note Other What brought you to our bank? Product Relationship with banker Location Dissatisfied with current bank Other Do you have any deposits come in automatically? Social Security Pay Roll Investment Other Do you know how many checks or withdrawals you plan to make a month? 1-5 6-10 11 or more 71

SAMPLE OF ENHANCED DUE DILIGENCE FOR HIGH RISK CUSTOMER: MONEY SERVICE BUSINESS QUESTIONNAIRE Money Service Business Questionnaire SECTION FIVE In your money service business, which of the following activities does your business engage in? Check Cashing Currency Exchange Issuers of traveler s checks, money orders or stored value Sellers of traveler s checks, money orders or stored value Redeemers of traveler s checks, money orders or stored value If you checked any of the above are these activities $1000 or more for any one customer in any one business day? Yes No Do you only do business In the United States International Both What will be the primary purpose of this account? What is your anticipated volume in this account? Are you engaged in the business of wire transfers? Yes No In your money service business identify yourself as one of the following: Principal Agent (Attach documentation proving agency status) Is your business: New business Date Formed: Existing business Years in business: Are the money service business activities Primary source of income Secondary source of income What percentage of income is derived from the money service side of your business? % If your business is in the United States, is it Local in your state Out of state Both Internal use only: Initial Assessment See internal risk sheet Low Risk Medium Risk High Risk 72

SECTION VI NONPROFIT ORGANIZATIONS & NONPROFIT CORPORATIONS SECTION SIX What is the purpose of the organization? Civic Benefit or Tragedy Political Campaign Public Fund Other How is your organization structured? Officers with regular meetings Board Steering Committee Other What geographic locations are served? County/Parish State United States International Who is the volunteer base? Local individuals in parish Statewide volunteers National volunteers International volunteers Where does the funding come from? Local donations Statewide donations National donations International donations 73

CONDUCTING THE INTERVIEW 1. When you are asking for all this information, remember it is important to keep an interested tone of voice and eye contact with the customer. 2. Try not to talk too much so that the customer has time to speak and answer your questions. 3. Make this as much about service as you can. When they ask why you need to know all this information, tell them you want to provide the best possible service for them. 4. You will have many opportunities along the way to present products, services and perhaps develop future opportunities if they perceive that you are interested in them. 5. Compliance officers please have the new accounts people develop the worksheets. If they can ask the questions the way that they want, what difference does it make to you as long as all tasks are accomplished? 6. We need to know these customers and the risks and hopefully, potential future business opportunities by building trust between you and them. 7. Follow up and check on them afterwards. You can verify phone numbers and thank them for their time and interest in your bank. 74

A NEW ACCOUNT INTERVIEW MIGHT LOOK LIKE THIS: Good morning! My name is Sally Jane Smith and you are? Mr. Bob Jones and Mrs. Betty Jones Mr. Jones. Welcome to the bank. How can I help you today? My wife and I would like to open an account. I am delighted to help you. I will need two forms of identification. We prefer driver s license and social security card if you have them. Tasks 1-5 Accomplished here. Do either of you have any other accounts at this bank? (Task #1) No Thanks for the identification. Is everything correct on your identification? The address is not correct. Do you happen to have a document, bill or anything else with current address? We have our phone bill. Or no we don t have anything with us. But we can drop it by later or fax it to you. Note: You will be completing your worksheets or photocopying identification. Some of you will check them on OFAC, Telecheck, Check systems and or run a credit report on the customer at this time. (Tasks 3 and 4) If unable to identify the customer, you will have to decline the account. If rely on verification after the customer leaves. You will have to check them out and go back and close the account. Don t forget you can place a hold on the funds till things are resolved. Follow Reg CC disclosure and policy. (Possible task 5 & 6) While this conversation is taking place you will complete your records and take whatever sales opportunities that are at your disposal. Some front line s assign risk and some send to the back of the house. During this check you will complete Tasks 7-12. The trickier part is getting the Due diligence in. Mr. and Mrs. Jones can I ask how did you learn about our bank? Saw your sign. May I ask what bank you are moving these funds from? ABC Bank down the street. Do you plan at this time to use any of our ATMs? Do you need a debit card? Will you be sending any wires, have any cash needs, OD Protection, OD Privilege? We do need a debit card, ATM and will have our paychecks automatically sent to this bank. 75

Use your worksheet to get this down. You are looking for high risk customers and services. If at any point you identify a high risk customer such as a nonresident alien or a money service business you should be prepared with some enhanced due diligence questions. We want my wife s name to be Mrs. Bob Jones. We would love to help you with that but we have to use the name as it appears on your driver s license. So her name must appear as it does on the identification. Sally Jane why do we have to give you so much information to open a checking account? It is now part of the USA Patriot Act requirements since 9/11. Also it helps us do the best possible job for you and provide you with the best account for the services that you need. Thank you for your patience today. We are delighted to have your business and would certainly like to help you with anything else you need. 76

OVERVIEW: PUTTING IT ALL TOGETHER WORKSHEETS Personal Account Business Account Personal Account Questionnaire Sections I-IV Business Account Questionnaire Sections I-IV Example Section V: Add Non-Resident Alien Questionnaire Example Section V: Add MSB Questionnaire for High Risk 77

* To do enhanced Due Diligence on High Risk Accounts you have to go farther. 78

WORKSHEET ON PERSONAL ACCOUNTS New Existing PROFILE PERSONAL ACCOUNTS COMPLETE PROFILE FOR EACH OWNER OR FIDUCIARY ON ACCOUNT (SOME BANKS MAY REQUIRE ONE ON EVERY SIGNER) SECTION ONE INFORMATION CUSTOMER NAME (AS IT APPEARS ON PRIMARY IDENTIFICATION) PHYSICAL ADDRESS DATE OF BIRTH SSN OR ITIN (IF NO SSN OR ITIN, PASSPORT NUMBER OR OTHER IDENTIFICATION NUMBER) SECTION TWO DOCUMENTS PRIMARY DOCUMENTS ACCEPTED BY FINANCIAL INSTITUTION Driver s License State Exp Nondriver s ID Card State Exp Passport Country Issued Exp Alien Registration Card Number Exp US Military Type Exp SECONDARY DOCUMENTS ACCEPTED BY FINANCIAL INSTITUTIONS Social security card Voter s registration Birth certificates Insurance cards Gun permits Company issued identification Credit Cards Birth certificates Student identification Tax return Pay stub Number if any Expiration date if any 79

* There are many types of secondary identification. You make a list that your institution can justify to examiners based on your risk. Expanded Primary Identification for Nonresident aliens Mexico Matricular Card National Identification Card Driver s License from their country Visas (See above notes about bank s decisions on identification for nonresident aliens) Expanded Secondary identification for Nonresident aliens ITIN Cards Any of the primary if have another primary (Mexico Matricular Cards, Visa, National Identification Cards etc) Birth certificates Voter s registration Tax return Does document verify residence or nationality? Additional Comments: If so which one? If not, how did the financial institution resolve the discrepancy? SECTION THREE Nondocument verification DOCUMENTS Check systems, telecheck, credit reports Customer telephone call Letter of welcome Site visit Previous bank reference Verification of employment whitepages.com google.com Secretary of State- online at www.sos.state.tx.us Regulation CC Hold Yes/No Circle One OFAC Check Yes/No Circle One If match, false positive or complete match Results: Resolve conflict in documents: Additional Comments: 80

SECTION FOUR Type of customer: New Existing customer adding new service Type of person: US Person Non US person Location of customer: HIDT Parish/County Non HIDT Parish/County Do you have any deposits come in automatically? Social Security Pay Roll Investment Other Do you plan to use the following: Internet banking ATM Other branches? If so where Wire services? If so where Lending Over Draft Protection Safe Deposit Boxes QUESTIONS Account opening method: In person all parties present In person, less than all parties present Mail Telephone Email, website Type of deposit: Cash On us transfer or check Payroll check Government Check Cashier s check Wire Foreign funds What brought you to our bank? Product Relationship with banker Location Dissatisfied with current bank Other Do you use automatic withdrawals? Utilities House note Other Do you know how many deposits you will make a month? 1-5 6-10 11 or more Do you know how many checks or withdrawals you plan to make a month? 1-5 6-10 11 or more 81

SECTION FIVE New Customer Existing Customer US Person (See US Person Worksheet) Non US Person (Attach W-8) Business Account (Complete Business Worksheet) Personal Account NON RESIDENT ALIEN ALTERNATE WORKSHEET Name (As it appears on Primary Identification) Nationality Residential/Street Address SSN/ITIN Date of Birth Home phone Work phone Employment/Student Contact Individual Documentary Verification Type of Identification: Select Two and one form of identification must have picture, description and signature Passport Temporary Resident Card Form I-688 Employment Authorization Card Form I-688A, I-688B, I-766 Nonimmigrant Visa & Border Crossing Card Refugee Travel Document Form I-571 US Department of State Driver s Licenses VISA Consular ID Cards Social Security Card Mexico Driver s License (32) Canada Card Expiration Nationality Number Card Expiration Nationality Number Non documentary Verification Type of None documentary Verification Letter of Welcome Third party verification: Type Check Systems, Credit report OFAC Other Resolution of Discrepancies 82

Type of customer: New Existing customer adding new service Type of person: US Person Non US person Source of funds: Are the funds coming from home? Where are the funds coming from to open this account? Bank where the funds are currently located Do you plan to use the following: Internet banking ATM Other branches? If so where Wire services? If so where Lending Over Draft Protection Safe Deposit Boxes Risk Assessment: Account opening method: In person all parties present In person, less than all parties present Mail Telephone Email, website Purpose of the account: Safety of US Banking System Family in the US Travel Frequently in the US Type of deposit: Cash On us transfer or check Payroll check Government Check Cashier s check Wire Foreign funds Do you know how many deposits you will make a month? 1-5 6-10 11 or more Location of customer: Nationality Do you use automatic withdrawals? Utilities House note Other What brought you to our bank? Product Relationship with banker Location Dissatisfied with current bank Other Do you have any deposits come in automatically? Social Security Pay Roll Investment Other Do you know how many checks or withdrawals you plan to make a month? 1-5 6-10 11 or more 83

WORKSHEET ON BUSINESS ACCOUNTS New Existing Exempt PROFILE BUSINESS ACCOUNTS COMPLETE PROFILE IF YOUR BANK REQUIRES INFORMATION ON ALL SIGNERS THEN USE PERSONAL SHEET ABOVE SECTION ONE INFORMATION BUSINESS NAME OR DBA NAME (AS IT APPEARS ON GOVERNMENT ISSUED DOCUMENT) PHYSICAL ADDRESS SSN OR EIN Sole Proprietors and Single member LLCs may use SSN of the owner SECTION TWO Sole Proprietor DOCUMENTS Assumed Name/Trade Name/Occupational License Circle One General Partnership Partnership Agreement, if any Partnership Registration, if any Limited Liability Partnership Partnership Agreement Partnership Registration Limited Partnership Partnership Agreement Partnership Registration Corporation Minutes of the Board Meeting 84

Certificate of Incorporation or Articles Stamped Filed Limited Liability Company Operating Agreement, if any Certificate of Formation or Articles stamped filed Agent, Escrow, Iolta, Public funds or other type of entity Nonprofit organization or club Formal Trusts Document as required by state or bank Otherwise have to identify all signers Charter, By-laws, minutes Otherwise have to identify all signers Trust Documents Other SECTION THREE Nondocument verification DOCUMENTS Check systems, telecheck, credit reports Customer telephone call Letter of welcome Site visit Previous bank reference Verification of employment whitepages.com google.com Secretary of State- online at www.sos.state.tx.us Regulation CC Hold Yes/No Circle One OFAC Check Yes/No Circle One If match, false positive or complete match Results: Resolve conflict in documents: Additional Comments: 85

SECTION FOUR Type of customer: New Existing customer adding new service Type of person: US Person Non US person Type of deposit: Cash On us transfer or check Payroll check Location of customer: HIDT Parish/County Non HIDT Parish/County Government Check Cashier s check Wire Foreign Fund What brought you to our bank? Product Relationship with banker Location Dissatisfied with current bank Other Do you have any deposits come in automatically? Pay Roll Operating Account Other Do you have any deposits come in automatically? YES NO Do you plan to use the following: Internet banking ATM, Debit Cards Other branches? If so where Wire services? If so where Lending Safe Deposit Boxes ACH Lockbox Do you have any cash needs for our branch? YES If yes, how much. QUESTIONS Account opening method: In person all parties present In person, less than all parties present Mail Telephone Email, website Type of business: Money Service Business (check cashing, wires, issuer or redeemer of cashiers checks, etc--fill out MSB questionnaire) Buying or selling motor vehicles of any kind, vessels, aircraft, farm equipment, or mobile homes Practicing law Accounting Practicing medicine Auctioning goods Chartering or operating ships, buses, or aircraft Gaming of any kind (other than licensed pari-mutuel betting at race tracks) Real estate brokerage Pawn brokerage Title insurance and real estate closing Trade union activities Other How close is your office? 1-5 miles 6-10 miles 11+ miles Do you use automatic withdrawals? Sweep Accounts Utilities Other Do you know how many deposits you will make a month? 1-5 6-10 11 or more Do you know how many checks or withdrawals you plan to make a month? 1-5 6-10 11 or more 86

SECTION FIVE In your money service business, which of the following activities does your business engage in? Check Cashing Currency Exchange Issuers of traveler s checks, money orders or stored value Sellers of traveler s checks, money orders or stored value Redeemers of traveler s checks, money orders or stored value If you checked any of the above are these activities $1000 or more for any one customer in any one business day? Yes No Do you only do business In the United States International Both Are you engaged in the business of wire transfers? Yes No In your money service business identify yourself as one of the following: Principal Agent (Attach documentation proving agency status) Is your business: New business Date Formed: Existing business Years in business: Are the money service business activities Primary source of income Secondary source of income What percentage of income is derived from the money service side of your business? % If your business is in the United States, is it Local in your state Out of state Both What will be the primary purpose of this account? What is your anticipated volume in this account? Internal use only: Initial Assessment See internal risk sheet Low Risk Medium Risk High Risk 87

SECTION SIX What is the purpose of the organization? Civic Benefit or Tragedy Political Campaign Public Fund Other How is your organization structured? Officers with regular meetings Board Steering Committee Other What geographic locations are served? County/Parish State United States International Who is the volunteer base? Local individuals in parish Statewide volunteers National volunteers International volunteers Where does the funding come from? Local donations Statewide donations National donations International donations 88

89