AML Compliance Findings & Observations

1. AML ComplianceFindings & Observations Wyn Clark U.S. Treasury

2. Summary • Suspicious and Unusual Findings • Transaction Activity • Business and Account Structures • Client Vetting Results • High Risk Clients • AML Program • Reporting and Recordkeeping • Risk Assessments • Risk Based Program • KYC Process • Staffing Levels and Experience • AML Compliance Integration into Business Units • Transaction Monitoring • Training • Testing and Audit

3. Transaction Activity • Suspicious activity?: • Structuring to avoid reporting requirements or detection • Rapid movement of funds • Transactions out of context with client’s “expected” activity • Unexplained complexity • No clear economic purpose • Domestic clients performing international transactions • Transactions involving high risk countries

4. Business and Account Structures • Business or Entity • Lack of transparency • Beneficial ownership • Overly complex or difficult to understand • Special purpose vehicles or entities • Foreign Business Entities • International Business Corporations • Private Investment Companies • Bearer shares • Shell company or bank • Nominees • Account • Unexplained accountholders and transactors

5. Client Vetting Results • Items that may cause concern • Unverified or inconsistent ID data points • Incomplete bank data or files • Negative news search findings • Legal issues • Court filings, arrests, warrants, convictions • Established clients vs. walk-ins • High risk clients and geographies

6. High Risk Clients • Who are the bank’s high risk clients ? • How are they flagged? (Manual vs. system) • New account approval • Risk Ratings • Impact on monitoring • Periodic reviews

7. Reporting and Recordkeeping • Are the basics being done correctly? • CTRs • SARs • KYC Data • Stated vs. Actual Account Purpose and Use • Law Enforcement Inquiries and Subpoenas • Transactional History • Investigations

8. Risk Assessment • Does the bank fully understand its business, clients, products, and the associated AML risks? • Assessment process: • Identify • Quantify • Mitigate • Residual • Risk assessment drives AML Program • Documented and supported • Independently reviewed and authenticated • Frequency appropriate

9. Risk Based Program • Bank managing to its risks, not its resources • Internal Controls • AML staff • Training • Audit and testing • Transaction monitoring • KYC and on-boarding • Bank staying current on the ever-changing trends in money laundering • Bank’s AML risks changing, is the AML program keeping up? • Clients, products and services, geographies, transactions • BUDGET!!!!

10. Internal Controls Risk Assessment • Develop Applicable: • Policies • Procedures • Systems • Controls • Identify & Measure Risk: • Products • Services • Customers • Geographic locations • Transactions Result Risk Based Program Risk Assessment Link to the BSA/AML Compliance Program – FFIEC Manual • Risk-Based BSA Compliance Program • Internal controls • Audit • BSA Compliance Officer • Training Repeat Process

11. KYC Process • How far does the on-boarding process go beyond verifying basic information? • Source of funds • Source of wealth • Purpose of account • RISK RATINGS? • Expected transactions and account activity • Is there connectivity between KYC (operations) and AML Compliance

12. Staffing Levels and Experience • Key areas to consider: • Seniority • Reporting lines • Experience and knowledge • Size of staff • Ongoing training • Roles and responsibilities

13. AML Compliance Integration into Lines of Business • Is AML Compliance keeping pace with changes at bank? • New products and services • Trade Finance, correspondent banking, mortgage financing • Expansion into new markets – domestic vs. international • New client types • Acquisitions • Volumes and complexities • AML Compliance responsibilities throughout entire bank • utilizing eyes and ears of all employees • Employee referral process • AML related communication to firm • Reminders, new laws and regs, policy and procedural changes

14. Transaction Monitoring • Transaction monitoring appropriate for transaction types or volume levels • Alert scenarios or report parameters consistent with actual transaction activity • Transactions compared to client or business type expected activity • All activity is being captured • Wires, checks, ATMs, journal entries • Monitoring Independently verified • Thresholds, scenarios

15. Transaction Monitoring • Review of closed alerts or exception reports by independent party • Risk based • Transaction monitoring generating meaningful SARs • Changes to monitoring adequately documented and tested • Who approved, what was changed, when changed, why was change made • Verification/testing of accuracy of information used in monitoring • Aged client data, human input errors, computer coding errors • Utilizing off-the-shelf systems and scenarios that aren’t appropriate for the bank

16. Training • Primary Considerations: • Content is risk based • Targeted to specific employees, functions • Frequency • Content refreshed or updated periodically • Receives independent review • Senior management and Board of Directors • Consequences for failure to take training

17. Independent Testing & Audit • Key Considerations: • Level of Independence • Scope is risk based • Staff knowledge • Use of Sampling where necessary • Ongoing oversight of AML Compliance changes at bank • Follow-up on corrective measures • Documented audit plan and procedures

18. Questions? • .