BSA/AML Examiner School - Case Study Oct 2023

Electronic banking

No electronic banking (e- banking) services offered, or products available are purely informational or non- transactional Some funds transfers for customers, noncustomers, limited third-party transactions, and some international funds transfers. No other types of international transactions, such as trade finance, cross border ACH, and management of sovereign debt.

The bank offers limited e- banking products and services.

The bank offers a wide array of e banking products and services (i.e., account transfers, e-bill payment or accounts opened via the Internet). A high number of customer and noncustomer funds transfers, including international funds transfers.

2

Funds Transfers

A moderate number of funds transfers, mostly for customers. Possibly a few international funds transfers from personal or business accounts.

1

Other Transactions

Limited other types of international transactions.

A high number of other types of international transactions.

1

Telephonic Banking

No telephonic banking services offered.

The bank offers limited telephonic banking services including account transfers, check balances and deposits. A small number of recent actions (i.e., actions within the last five years) by OFAC, including notice letters, or civil money penalties, with evidence that the bank addressed the issues and is not at risk of similar violations in the future.

The bank offers a wide array of telephonic banking services on the deposit and loan products. Multiple recent actions by OFAC, where the bank has not addressed the issues, thus leading to an increased risk of the bank undertaking similar violations in the future.

2

OFAC Actions

No history of OFAC actions. No evidence of apparent violation or circumstances that might lead to a violation.

1

Total 10 The average risk score for the bank is 1.25; therefore, we conclude the bank's risk for encountering an OFAC issue is low. IX. Acting on the Risk Assessment We do not feel any policies or procedures need to be implemented or changed based on the risk assessment. The policies and procedures are deemed adequate at this time. At such time that our matrix changes or circumstances change, a recommendation will be made to the Board to modify or change the policies. Any changes in procedures or internal controls will be reported to the Board.

5