BSA-AML Examiner School Case Study eBook

Internal Use Only

BSA/AML Policy and Program

● Emerging BSA/AML/OFAC compliance issues which the Bank will need to address. 6. INDEPENDENT TESTING The Board designates responsibility for periodic independent testing of BSA/AML/OFAC compliance to external audit. The third-party auditor will conduct independent testing annually at a minimum, and more often if warranted. The CCO will determine the scope of the testing and will report its findings to the Board. At a minimum, the testing will provide an opinion as to the effectiveness of the Bank’s BSA/AML/OFAC program and the adequacy of controls over BSA/AML/OFAC compliance risk. The Bank will require Fintech Partners to conduct independent testing on an annual basis (or more frequently if warranted). The Fintech Partner will submit the proposed scope and independent tester to TS&J’s BSA/AML Officer or their designee for approval prior to commencing the review. 7. MONITORING AND REPORTING The BSA/AML Officer will adhere to the monitoring and reporting requirements outlined in Section 6.C. of this Policy/Program. 8. COMMUNICATION AND TRAINING In addition to the responsibilities outlined in Section 6.C.4 of this Policy, the BSA/AML Officer will communicate changes to this Policy to relevant stakeholders prior to the effective date of the changes, as necessary. The Policy will be available to all employees in a central and easily accessible location. For Third Parties with responsibilities under this Policy, the BSA/AML Officer, working with Third Party Risk Management, will ensure the Third Parties receive appropriate training, either through the Bank or the Third Party, with any Third Party training activities evaluated as part of third-party due diligence and ongoing monitoring. 9. POLICY EXCEPTIONS Any employee who discovers a potential instance of non-compliance with this Policy/Programmust report it to the BSA/AML Officer. The BSA/AML Officer will escalate any exceptions to this Policy/Program to the Board, developing an action plan to remediate any exceptions, as necessary. Employees found to be in violation of a Policy/Programmay face disciplinary actions, up to and including termination of employment. Questions or suggestions concerning this Policy/Program should be forwarded to the

29

Confidential