BSA/AML Examiner School - Case Study Oct 2023

• Automated clearinghouse (ACH) • Commercial loans/letters of credit • Retail banking — new accounts, tellers All areas of the Bank are responsible for implementation of compliance requirements, policies and procedures for OFAC regulations. Audit Program The external auditors will conduct independent annual audits of the Bank's OFAC policy and procedures. The Bank conducts internal audits on the effectiveness of the OFAC Compliance Program on an annual basis. Audit personnel are instructed to conduct a comprehensive evaluation of the Bank's OFAC policies, procedures and other compliance requirements to ensure the Bank has properly assessed its compliance risks across the spectrum of all of its activities. The external auditors will report the results of the audits to the Board of Directors. The reports will contain management responses and any corrective action taken to resolve audit exceptions. Recordkeeping and Record Retention The Bank will keep a full and accurate record of each transaction engaged in sanctioned countries and entities regardless of whether such transaction is effected pursuant to license for five years after the date of such transaction. The BSA/OFAC must ensure that the Bank keep a full and accurate record of each blocked or rejected transaction for at least 5 years after the date of the transaction. For blocked property, records must be maintained for the period the property is blocked and for five years after the date the property is unblocked. The Bank will also maintain copies of customers' OFAC licenses to initiate a legal transaction for a minimum of 5 years, following the most recent transaction conducted in accordance with the license.

For Training Purposes Only

Page 19