BSA/AML Student Exercises Dec. 2022

BSA/AML Examiner School Student Exercises

December 5-9 , 2022

@ www.csbs.org � @csbsnews

CONFERENCE OF STATE BANK SUPERVISORS 1129 20th Street NW / 9th Floor / Washington, DC 20036 / (202) 296-2840

Internal Use Only

BSA/AML EXAMINER SCHOOL AJ&R Bank & Trust Case Study Introduction

Over the remainder of the week, you will be completing a case study of AJ&R Bank & Trust. For most areas, we will discuss exam concepts and you will apply the concepts by reviewing materials related to the case study. The case study is based on an actual examination of an institution. However, the personal identifying information of the customers and the institution were changed. Later in the week, the outcomes from the examination will be shared with you. The case study is intended to simulate a BSA examination. As such, you will have the opportunity to ask the BSA Officer [ your instructors ] questions on two occasions. You should write down any questions that you have during the exam planning exercise because the initial BSA Officer interview will occur tomorrow. Later in the week, you will develop your conclusions and conduct a simulated BSA Officer exit meeting. To ensure you have a successful experience, you will want to document any potential exceptions, findings, or violations you identify during the transaction testing exercises. Those will help you develop your findings and conclusions related to the BSA program at AJ&R Bank & Trust to discuss with the BSA Officer during the meeting. AJ&R Bank & Trust is a community bank located in a rural area with total assets of $37 million. The bank is locally owned and consists of one full-service location. The local economy is weak with limited commercial loan opportunities. The ratings from the prior exam were 2-2-4-3-2-2/4. The prior exam report stated that the BSA program was satisfactory, and the institution satisfactorily complies with OFAC requirements.

BANK SECRECY ACT REQUEST LIST

Internal Use Only

Institution:

AJ & R Bank & Trust

Examination Date: July 1, 2016 Items marked as "Onsite" should be retained in your offices for examiner review during the on-site portion of the examination. The remaining items should be furnished to examiners by June 24, 2016. For documents that are too long for convenient copying, please provide originals for examiner review at the institution. Clearly identify all items that should be returned to bank personnel.

BANK SECRECY ACT Item # Onsite

Item Description

20.01

Name and title of the designated BSA/AML compliance officer and, if different, the name and title of the person responsible for monitoring OFAC compliance. If a complex reporting structure, provide organizational charts showing direct and indirect reporting lines. BSA/AML/OFAC policies and procedures to comply with all reporting and recordkeeping requirements, including suspicious activity, customer due diligence, and CIP. Correspondence with and subpoenas from the U.S. Treasury (Office of the Secretary and Department of the Treasury, Internal Revenue Service, FinCEN, and OFAC) or law enforcement authorities since the previous BSA/AML examination. Audit schedule and independent audits/tests performed since the previous BSA/AML/OFAC examination. Include the scope, management's responses, and access to the workpapers. BSA/OFAC Risk Assessment of products, services, customers, and geographic locations. Also, provide a list of high-risk account holders. X Summary of training program (e.g., materials used for training since the previous BSA/AML examination). X BSA/AML training schedule with dates, attendees, and topics. A list of persons in positions for which the bank typically requires BSA/AML training but who did not participate in the training. X Account opening forms (e.g., for loans, deposits, or other accounts) used to document CIP/Customer Due Diligence information. List of new accounts (opened for new customers of the bank) covering all product lines (including accounts opened by third parties) from 09/01/2015to 07/08/2016. X X List of accounts without taxpayer identification numbers (TINs). X

20.02

20.03

20.04

20.05

20.06

20.07

21.01

21.02

21.03

21.04

X

List of Money Service Business customers.

21.05

X

List of all high risk customers of the bank.

FDIC

1

05/27/2016

BANK SECRECY ACT REQUEST LIST

Internal Use Only

21.06

X

List of accounts opened with CIP exceptions between 07/15/15 – 07/08/16.

22.01

X Access to Suspicious Activity Reports (SARs) filed with FinCEN since the last exam and the supporting documentation. Include copies of any filed SARs that were related to section 314(a) 31 CFR Chapter X 1010.520 requests for information or to section 314(b) 31 CFR Chapter X 1010.540 information sharing requests. X Any analyses or documentation of any activity for which a SAR was considered but not filed, or for which the bank is actively considering filing a SAR. Internal reports used to identify reportable currency transactions from 06/02/2016 to 06/20/2016. List of customers exempted from CTR filing and the documentation to support the exemption (e.g., currency transaction history). Documentation of any positive match for a section 31 CFR 1010.520 (formerly 314a) request. Records of sales of monetary instruments in amounts between $3,000 and $10,000 (if maintained with individual transactions, provide samples of the record made in connection with the sale of each type of monetary instrument). Funds transfer activity logs for transfers into and out of the bank, including funds transfers that involve cover payments. Include the number and dollar volume of wire transfer activity for the month. X List of funds transfers purchased with currency from 07/01/2015 to 07/11/2016. X List of blocked or rejected transactions with individuals or entities on the OFAC list and reported to OFAC. List of software and service providers used by the bank for BSA/AML/USA PATRIOT Act and OFAC compliance purposes. Contract with vendor used to perform OFAC checks against new and existing customer names. X X X X X X X

22.02

23.01

23.02

24.01

25.01

26.01

26.02

27.01

28.01

28.02

FDIC

2

05/27/2016

From: EIC@Statebankingagency.org Sent: July 6, 2016 To: Allexamstaff@Statebankingagency.org Subject: AJ&R Bank& Trust examination

Examination Team,

Good afternoon team. I just finished our pre-examination call with AJ&R Bank & Trust Company. President England brought up some important information regarding the examination. Several of the main players in this institution were fired as of June 30, 2016. Chief Financial Officer Bailey Placier, who was the former Chief Executive Officer during the 2014 exam, was terminated due to repeated issues found in her work. Human Resource Officer and Teller Supervisor Lawrence Lance was fired along with Loan Officer and Information Security Officer Fred Murray. Then the prior BSA Officer Amanda Smith was fired due to suspected theft of money out of her teller drawer. It looks like the Board got tired of the issues and cleaned house. Hopefully, this will mean that they are headed in the right direction. I filled out the organizational chart based on this information, which I have attached. President England also stated that James Bright, who has had a long history with being a dominant official at this institution, is still impeding him from doing his job. President England was hired in 2015, and this will be the second examination as President. For those of you that this is their first time at this institution, James Bright is the largest primary shareholder and has a history of being very heavily involved in this institution. Examiners have also found that in the past he has delayed the correction of the deficiencies, identified by both regulators and external auditors, at this institution. Between his wife and himself, the Bright’s control 24% of the outstanding shares. Also, be aware that he has made statements in the past that he “selected” the board members. Although that has not helped him as discontinuity in the Board continues to be a large problem at this institution. There has been noticeable split between members of the Board as it has appeared that they have divided up into two factions. You will notice this when you read the board minutes. One of the factions of the Board supports Bright and the other openly opposes him. Bright fully supported former CFO Placier in the CEO position, even though she was ineffective in that position and did not correct deficiencies in the institution. He disagreed with her recent departure and opposes current President England. If examiners are approached by Director Bright, they should always have another examiner present.

For Training Purposes Only

1

From: EIC@Statebankingagency.org Sent: July 6, 2016 To: BSAexaminer@statebankingagency.org Subject: AJ&R Bank & Trust BSA examination

Thank you for helping out with this examination. Look over the prior exam comment. The prior BSA Officer Smith cleaned up the BSA program at the prior examination. There was one violation and one recommendation cited at the prior exam. I am a little concerned that the prior BSA Officer was fired of suspected theft from the institution. Julie Collins is filling in that role on a temporary basis. She is also the Compliance Officer. She is assisted by Amy Grant, who is also the Head Teller, Operations Officer, Information Technology Officer, and is helping Harry with the Human Resource Officer duties. The following will give you a little history with this institution and their BSA program. During the 2014 examination, the institution was downgraded from a “2” to a “4” and the ratings were as followed 224322/4 with an emphasis on the “4” rating for management. The deficient rating was a result of management and the deficient level of internal controls and risk management practices. Examiners found that there was inadequate staffing of positions considered critical to bank operations which resulted in the aforementioned breakdown in internal controls. Examiners also found significant non compliance with rules, regulations, and regulatory policies. At that examination, the BSA program was considered “deficient”, which represented a downgrade from “satisfactory. The reason for the down grade was due to a breakdown of internal controls and non-compliance with BSA related rules and regulations. During the 2015 examination, which was a joint exam with our federal counterparts, the condition of the institution deteriorated, yet remained a “4”. The ratings were 2-3-5-3-3-4/4. The Board and management were deemed to be critically deficient, and risk management practices were considered significantly inadequate. Management was not in compliance with provisions of the order. On the bright side, BSA was once again returned to “satisfactory”. Management has shown substantial improvement in this area, albeit it seems this area alone. At this examination, the only findings were a violation and one recommendation regarding a suspicious activity report. OFAC, as always, has been satisfactory.

For Training Purposes Only

2

Examination Conclusions and Comments (Continued) Bank Secrecy Act (BSA)

The BSA program and compliance with related laws and regulations has improved and is now satisfactory. The Board approved the Bank Secrecy Act /Anti-Money Laundering / Office of Foreign Asset Control Policy on January 22, 2015. The policy is considered adequate and comprehensive of all BSA-related areas. The Board reappointed Amanda Smith as BSA Officer during the May meeting. The Customer Identification Program (CIP) policies are included in the policy, and the procedures are considered satisfactory. Better Bank Corporation (BBC) conducted the most recent independent audit as of September 2014. BBC identified multiple significant recommendations and identified non-compliance with several BSA related laws. As a result, BBC rated the program as needs improvement, and an interim audit occurred in April 2015. Examiners reviewed the draft report during the examination, which concluded the majority of the deficiencies had been addressed. The interim audit did raise concerns in the cohesiveness of the BSA program, the BSA Officer, and the documentation of training. Training now occurs regularly and is now considered appropriate. Adherence with CIP and OFAC requirements are also found to be appropriate. While overall improvement is evident, an isolated apparent violation of Chapter X of the Treasury Department’s Financial Crimes Enforcement Network is cited for failure to file a CTR within the required timeframe. Currency Transaction Reports Management failed to file a CTR within the appropriate time frame. Management monitors transactions daily through a daily cash report, which aggregates transactions greater than $3,000, in order to identify if a CTR should be filed. While management generally identifies transactions, an isolated incident was identified by examiners during the examination in which a CTR was filed in excess of the 15-day time frame. An apparent violation of Section 1010.306(a)(1) of 31 C.F.R. Chapter X is cited. This is a repeat violation from the prior examination. Management should develop processes to ensure CTRs are identified and filed appropriately going forward. Refer to the Violations of Laws and Regulations page of this report for further information. BSA Officer Smith stated that CTRs will be filed within the required time frame going forward. Suspicious Activity Reports (SARs) While SARs generally contain the necessary information to detail the suspicious activity, management should strengthen the narratives included in the SARs. In particular, the narratives should include more detail regarding the individual involved in the transaction, such as occupation, length and type of relationship to the institution, and why the transaction is suspicious. BSA Officer Smith stated that SAR narratives would be enhanced going forward, to include the recommendations. Office of Foreign Asset Control Effective policies and procedures are in place to ensure satisfactory compliance with OFAC regulations.

For Training Purposes Only

3

Compliance Officer (1)

Board of Directors

BSA Officer (1)

Julie Collins

Julie Collins

Chairman of the Board

President & CEO (1)

Harry England

Operations (1)

Lending (4)

HR & Security (6)

Senior Lending Officer (1) Clint Brentwood

HR Officer (1)

CFO (1)

Operations Officer (1)

Harry England/ Amy Grant

Harry England

Amy Grant

Residential & Commercial Loan Officer (1)

Accounting Assistant (1)

Deposit Administration

James Todd

Head Teller (1)

Amy Grant

Loan Administration

CSRs

Tellers (4)

Information Technology

Loan Processing (1)

Amy Grant

Loan Operations (1)

Total Employees = 14

Organizational Chart - Final

CONFIDENTIAL

AJ&R BANK & TRUST Bank Secrecy Act, Anti-Money Laundering and OFAC Compliance Program May 20, 2015

Table of Contents

POLICY DESCRIPTION, AUTHORITY AND SCOPE........................................................................... 5 I. Penalties ........................................................................................................................................... 5 II. BSA/AML/OFAC COMPLIANCE PROGRAM ........................................................................ 5 III. BSA Risk Assessment .................................................................................................................. 5 IV. System of Internal Controls ......................................................................................................... 6 V. Independent Audits ...................................................................................................................... 6 VI. Designation of BSA Officer ......................................................................................................... 6 VII. Training of all Staff Personnel ..................................................................................................... 6 INTERNAL CONTROLS/REGULATORY REQUIREMENTS .............................................................. 7 VIII. Anti-Money Laundering Policy and Procedures ...................................................................... 7 Integration ........................................................................................................................................... 7 Procedures for Complying with Anti-Money Laundering.................................................................. 8 High Risk Customers .......................................................................................................................... 9 IX. Detecting Suspicious Activity – “RED FLAGS”......................................................................... 9 Structure Transactions ...................................................................................................................... 10 General "Red Flags" for Suspicious Activity ................................................................................... 10 Red Flags for Customer Service/New Account Representatives/Safe Deposit Staff ....................... 11 Red Flags for Wire Transfers Used in Money Laundering............................................................... 12 Red Flags in Foreign Correspondent Banking.................................................................................. 13 Red Flags in Private Banking Accounts ........................................................................................... 13 Red Flags for Lenders ....................................................................................................................... 14 X. Customer Identification Program Policy and Procedures .......................................................... 14 Definitions......................................................................................................................................... 15 Verifying Account Opening Documentation .................................................................................... 16 Loan Customers and CIF .................................................................................................................. 17 Foreign Customers and CIP .............................................................................................................. 17 Lack of Verification.......................................................................................................................... 17 Opening Accounts When the Customer Is Not Present at the Bank................................................. 17 Comparison with Government Lists ................................................................................................. 18

For Training Purposes Only

Page 1

Customer Notification....................................................................................................................... 18 Recordkeeping .................................................................................................................................. 18 XI. Customer Due Diligence and Enhanced Due Diligence Policy and Procedures........................ 19 Customer Due Diligence for all Customers ...................................................................................... 19 Customer Due Diligence Program Checklist:................................................................................... 20 Enhanced Due Diligence for High-Risk Customer........................................................................... 20 CIP vs. Customer Due Diligence ...................................................................................................... 22 Customer Due Diligence (CDD) - New Customers.......................................................................... 23 Enhanced Due Diligence- High Risk Customers.............................................................................. 23 Monitoring High Risk Customers for Unusual Account Activity .................................................... 23 Identifying and Classifying Existing Accounts as High Risk accounts............................................ 24 Individual Selection of High Risk Customers .................................................................................. 24 Questions for All Customers............................................................................................................. 24 Questions Specifically for Consumers to Identify High Risk........................................................... 25 Questions Specifically for Business Customers to identify High Risk............................................. 25 Enhanced Customer Due Diligence-CDD Procedures ..................................................................... 26 Expanded Review Procedures for Enhanced Due Diligence ............................................................ 26 Nonresident Aliens (NRA) and Foreign Individuals Procedures ..................................................... 26 Non-Bank Financial Institutions Procedures .................................................................................... 27 Professional Service Providers (Doctors, Attorneys, etc.) Procedures ............................................. 27 Private Banking Due Diligence Program (Non-US Persons) ........................................................... 27 Enhanced Customer Due Diligence-EDD ........................................................................................ 28 Enhanced Scrutiny of Private Banking Accounts for Senior Foreign Political Figures ................... 28 Foreign Correspondent Banking — Recordkeeping and Enhanced Due Diligence Program .......... 29 Special Due Diligence Program For Foreign Correspondent Accounts ........................................... 29 Customer Due Diligence for All Foreign Correspondent Accounts ................................................. 29 Enhanced Due Diligence for High-Risk Correspondent Banks........................................................ 30 Special Procedures When Due Diligence Cannot Be Performed ..................................................... 31 Foreign Correspondent Account Recordkeeping.............................................................................. 31 Record Retention .............................................................................................................................. 32 Politically Exposed Persons (PEP) and Enhanced Customer Due Diligence ................................... 32 PEP Accounts Enhanced Customer Due Diligence-EDO ................................................................ 33 PEP Due Diligence Procedures ........................................................................................................ 33 Money Services Businesses Guidelines............................................................................................ 33

For Training Purposes Only

Page 2

Minimum Bank Secrecy Act Due Diligence Guidelines .................................................................. 34 Bank Secrecy Act/Anti-Money Laundering Risk Assessment Guidelines....................................... 35 Due Diligence Guidelines for Higher Risk Customers..................................................................... 36 Identification and Reporting of Suspicious Activity Guidelines ...................................................... 37 XII. Suspicious Activity Report (SAR) Policy and Procedures ........................................................ 38 Overview........................................................................................................................................... 38 Suspicious Activity Reporting Process ............................................................................................. 38 Notification of the SAR filing to the Board of Directors.................................................................. 39 Confidentiality .................................................................................................................................. 39 Sharing Suspicious Activity Reports ................................................................................................ 40 Safe Harbor ....................................................................................................................................... 40 Record Retention .............................................................................................................................. 40 XIII. Currency Transaction Reporting (CTR) Policy and Procedures ............................................ 41 Overview........................................................................................................................................... 41 CTR Verification .............................................................................................................................. 41 Filing Timeframes and Record Retention Requirements.................................................................. 41 Monitoring Cash Activity ................................................................................................................. 41 XIV. Currency Transaction Reporting Exemption Policy and Procedures ..................................... 42 Overview........................................................................................................................................... 42 Exemptions ....................................................................................................................................... 42 Ineligible Businesses......................................................................................................................... 43 Effect on Other Regulatory Requirements........................................................................................ 44 XV. Purchase and Sale of Monetary Instruments Recordkeeping Policy and Procedures ................ 44 Overview........................................................................................................................................... 44 XVI. Funds Transfer Recordkeeping Policy and Procedures .......................................................... 45 Overview........................................................................................................................................... 45 Procedures......................................................................................................................................... 45 Procedures: Funds Transfers............................................................................................................. 46 Recordkeeping Procedures for Banks ............................................................................................... 46 Travel Rule Requirements ................................................................................................................ 47 Recordkeeping Requirements for Incoming Wires........................................................................... 47 Pay Upon Proper Identification ........................................................................................................ 48 Retrievability Rules .......................................................................................................................... 48 OFAC Compliance............................................................................................................................ 48

For Training Purposes Only

Page 3

XVII. Information Sharing – USA PATRIOT Act Policy and Procedures ...................................... 48 Overview........................................................................................................................................... 48 Section 314(a) ................................................................................................................................... 48 Section 314(b) ................................................................................................................................... 49 Notice Requirement .......................................................................................................................... 50 Verification Requirement.................................................................................................................. 50 Use of Information............................................................................................................................ 50 Safe Harbor Liability ........................................................................................................................ 50 Information Sharing Between Financial Institution and the Federal Government ........................... 50 XVIII. Office of Foreign Assets Control (OFAC) Policy and Procedures..................................... 50 Overview........................................................................................................................................... 50 OFAC Compliance Program............................................................................................................. 51 Update Scanning for OFAC.............................................................................................................. 52 Structure of Accountability............................................................................................................... 52 Maintaining License Information ..................................................................................................... 53 Blocking/Rejecting Transactions ...................................................................................................... 54 Training............................................................................................................................................. 54 Civil Penalties ................................................................................................................................... 55 Audit Program................................................................................................................................... 55 Recordkeeping and Record Retention .............................................................................................. 55 Wire Transfers Department Procedures............................................................................................ 55 OFAC Screening for ACH Transactions .......................................................................................... 56 Commercial Loans/Consumer Loans/Letters of Credit .................................................................... 56 Real Estate Loans.............................................................................................................................. 57 Retail Banking — New Accounts and Operations Personnel........................................................... 57 XIX. Special Measures (Section 311 of the Patriot Act) Policy and Procedures ............................ 58 Overview........................................................................................................................................... 58 Special Measures .............................................................................................................................. 58 XX. Additional Retention of Records Policy and Procedures ........................................................... 59 Overview........................................................................................................................................... 59 NOTE: All officers of the Bank are responsible for the comprehension and implementation of this program and ensuring their employees understanding of their responsibilities. If at any time an employee is uncertain about the proper method of handling a situation or transaction, he or she should refer the issue to their immediate supervisor or contact the BSA/AML Officer for further clarification.

For Training Purposes Only

Page 4

POLICY DESCRIPTION, AUTHORITY AND SCOPE

I. Penalties All employees must be aware of the penalties for money laundering. Substantial civil and criminal penalties are provided in the law for failure on the part of the Bank or any employee to report or supply information, and for filing a false or fraudulent report, or for an employee to knowingly engage in a financial transaction which involves the proceeds of unlawful activities. Individuals, including bank employees, convicted of aiding and assisting in money laundering face up to 20 years in prison for each money laundering transaction. Businesses, including banks and individuals, face fines up to the greater of $500,000 or twice the value of the transaction. Any property involved in the transaction or traceable to the proceeds of the criminal activity, including loan collateral, personal property, under certain conditions, entire bank accounts (even if some of the money in the account is legitimate) may be subject to forfeiture. In addition, to such penalties, regulators have the authority to revoke the charter or terminate the deposit insurance of a bank convicted of money laundering and BSA violations. The BSA/AMUOFAC Compliance Program is designed to avoid such violations and to assure compliance with the Bank's reporting responsibilities. Under no circumstances shall employees discuss these procedures with customers or provide customers with any advice as to the manner in which reporting requirements can be avoided. II. BSA/AML/OFAC COMPLIANCE PROGRAM General goals of the Bank's BSA Program consist of: 1. Developing a BSA/AML/OFAC risk profile of the Bank to design effective risk-based internal controls. 2. A system of internal controls to ensure ongoing compliance based on the BSA Risk Assessment. 3. Independent audits to ensure ongoing compliance conducted by either Bank personnel or a third party entity consultant. 4. Designation of a Bank Secrecy Act Officer responsible for coordinating and monitoring day to day compliance. 5. Training of all Bank personnel on an annual basis. III. BSA Risk Assessment The Bank has developed a risk assessment that identifies the Bank's BSA/AML and OFAC risk profile. Our risk assessment consists of the following: • Assessment of new products, services, assessment of targeted customers, entities and geographic locations. • The risk assessment program is an ongoing process. It is the responsibility of the Board of Directors and Senior Management to ensure the Bank's risk assessment is updated annually to identify changes in the Bank's risk profile (i.e., when new products and services are introduced, existing products and services change, high risk customer's open and close accounts, or the Bank expands through mergers and acquisitions). The BSA/AML Compliance Program was developed based on our risk assessment.

For Training Purposes Only

Page 5

IV. System of Internal Controls The Bank will maintain an effective BSA, AML and OFAC internal control structure, including suspicious activity monitoring and reporting. Proper Internal controls have been implemented to adhere with all the requirements of the BSA laws, regulations and the Bank Secrecy Act/Anti Money Laundering Examination Manual. www.ffiec.00v/bsa aml infobase/default.htm V. Independent Audits It is the policy of the Bank to conduct an independent annual audit by internal and/or external auditors to ensure complete adherence of the Bank Secrecy Act. Results of this audit will be reported to the Board of Directors Audit/Compliance Committee and the BSA Compliance Officer. Senior Management and the BSA Compliance Officer will take appropriate action to correct any exceptions found as a result of the audit. The Bank's external auditors will conduct an objective independent evaluation of the Bank's written BSA/AML and OFAC Compliance Program, perform testing for specific compliance with the BSA, and evaluate pertinent management information systems (MIS) and the quality of risk management for all banking operations, departments and subsidiaries. The audit shall include all requirements specified by the BSA laws and regulations, as well as the BSA Examination Manual. www.ffiec.gov/bsa aml infobase/default.htm VI. Designation of BSA Officer The Board of Directors is responsible to appoint a BSA Compliance officer on an annual basis, The Board of Directors has designated Kelli Bowen to serve as the BSA Compliance Officer (BSA/AMUOFAC Officer) all decisions made by The Board of Directors must be noted in the board minutes. The Board of Directors has granted the BSA Compliance Officer with the authority, subject to the approval and supervision of the Board of Directors and Senior Management, to develop and administer a program that provides for Bank Secrecy Act compliance and training. This includes assuming full responsibility for all Bank Secrecy Act policy statements and procedures. The BSA Compliance Officer is required to be fully knowledgeable of the BSA and all related regulations, and also understand the Bank's products, services, customers, geographic locations, and the potential money laundering and terrorist financing risks associated with those activities . VII. Training of all Staff Personnel The Bank is required to ensure that all personnel receive training on the directives of the Bank Secrecy Act on a scheduled basis. All employees of the bank will be trained annually. Training will include regulatory requirements and the Bank's internal BSA, AML and OFAC policies, procedures and processes. The Bank's training program will provide training for all personnel whose duties require knowledge of the BSA, and the training is to be tailored to the person's specific responsibilities. Additional trainings may be via email or hard copy of the training materials. In addition, an overview of the BSA, AML and OFAC requirements are to be provided to new staff during the employee orientation process conducted by the Human Resources Department. Documentation of personnel trained, and the dates of training will be maintained by the BSA Department. Considering the frequent changes to the law and the BSA requirements, the BSA Compliance Officer will attend several external training sessions annually. In addition, other designated members of the BSA Department and Bank management will periodically attend educational programs related to the Bank Secrecy Act as well.

For Training Purposes Only

Page 6

The Board of Directors will be provided with annual training on the general BSA requirements. The BOD is required to understand the importance of BSA, AML and OFAC regulatory requirements, the ramifications of noncompliance, and the risks posed to the Bank. The BOD will be informed of changes and new developments in the BSA, its implementing regulations and directives, and the federal banking agencies' regulations. All Bank officers are responsible for acquainting themselves with the Bank's policies and procedures in this area and ensuring that their employees understand their responsibilities. Furthermore, management personnel are responsible for encouraging their employees to complete all BSA trainings under the direction of the BSA Compliance Officer. VIII. Anti-Money Laundering Policy and Procedures The Bank's policy is to ensure proper adherence to the provisions and intent of the USA Patriot Act. The Bank Secrecy Act (BSA) requires the Bank to have procedures in place to assist in detecting and preventing money laundering activities and other illegal activities conducted at the Bank. Money is "laundered" to conceal all types of criminal activity, including drug trafficking, which accounts for the majority of "dirty' money in the United States. Experts have estimated the amount of laundered drug money each year in billions. Money laundering is driven by criminal activities and the need to conceal the true source of funds. It becomes necessary only when the amount of cash is so large the criminal cannot absorb it into his or her lifestyle by spending it. Anti-money laundering procedures affect the following areas of the Bank: 1. Operations; 2. Lending; 3. Sale of Monetary Instruments; 4. Wire Transfers; and 5. One of the best methods for Bank staff to avoid being an unknowing accomplice to money launders is to properly identify new customers when their account is opened. Minimum identification requirements listed in the Customer Identification Program purchases assets such as vehicles or gold that can be easily resold domestically or overseas, the identity of the purchaser is easier to hide and the assets more difficult to locate and seize. Integration Provides an apparent legitimate explanation for the illicit funds. This could mean using the property described above as collateral for a loan that results in "clean" money being generated for the criminal. Some criminals use a foreign bank account and the participation of well-placed employees at both the US and foreign bank in the same loan schemes. Also, false import/export invoices can be effective ways to hide dirty money. Generally, this type of scheme involves the over estimation of entry documents to justify the funds that are later deposited to US banks or the over estimation of exports to ship money out of the country. The weakest link in the laundering process is in the bulk cash placement stage. For money laundering to be successful there must be no paper trail. This is why the Bank is asked to follow such stringent record keeping guidelines on certain types of transactions. Frequently, investigators are hampered by large number of transfers between accounts to obscure the trail of funds. The Bank is committed to helping INTERNAL CONTROLS/REGULATORY REQUIREMENTS

For Training Purposes Only

Page 7

authorities by having procedures in place to detect and report such suspicious activities. Should any of these types of money laundering activities be suspected; the account is to be periodically monitored as part of the Bank's investigation. The BSA Officer is responsible for reviewing any such activity and determining whether a Suspicious Activity Report (SAR) should be filed. Procedures for Complying with Anti-Money Laundering The Bank maintains a comprehensive system of detecting and deterring such transactions that is commensurate with the Bank's risk for money laundering and terrorist financing. The Bank's Anti Money Laundering Program assists the BSA Department and Senior Management in the analysis of cash, wire, loan, monetary instrument transactions and customer profiles and identifies high risk accounts. Proper procedures have been implemented to comply with Anti-Money Laundering rules. The following reports and procedures are part of our Anti-Money Laundering Program:  Detecting Suspicious Activity — "Red Flags"  Customer Due Diligence and Enhanced Customer Due Diligence Policy and Procedures  Politically Exposed Persons (PEP)  High Risk Customers Listing  Suspicious Activity Report Policy and Procedures  Customer Identification Policy and Procedures (CIP)  Bank's Fraud Detection Report or system  BSA Department daily procedures  Name of Banks system Reports utilized to monitor account activity. The following reports may assist management, officers and staff in detecting and monitoring unusual or suspicious activity:  Suspect kite report — This report identifies excessive activity in accounts and should be reviewed for cash activity. The account profile of an account used for money laundering can be similar to that of an account used for check kiting: high volume of activity, matching deposits and withdrawals, and low average balances in relation to activity.  Overdraft report — This report can be used to assist management or account officers to detect when a "good" customer, either individual or commercial, is suddenly having financial problems.  Delinquent loan reports — Although these reports generally get special attention, management or account officers are directed to pay close attention when delinquent loans are suddenly brought up current with no reasonable explanation in the file. Loan officers must be able to explain a sudden pay-off of seriously delinquent accounts and refer the account to the BSA officer.  Demand deposit activity reports — These reports cover all customer and employee accounts, they show daily balances and accumulate deposits and withdrawals over a 30-days period. Management may establish a threshold for certain types of accounts and review only the exceptions.  Large transaction reports — These reports will be set at an amount lower than $10,000 to identify customers who might be structuring transactions to avoid CTR reporting or who have unusual activity in their account. Ensure that transaction amounts are consistent with the type of business or occupation of the customer. These reports will also serve to monitor "exempt persons" accounts for unusual or suspicious activity.  Incoming and Outgoing wire transfer report — This report identifies transfers of funds out of the country or to remote banks, transfers funded by cashier's checks or money orders in amounts under the CTR filing threshold and other suspicious activity of accountholders.

For Training Purposes Only

Page 8

 Hold notices for Regulation CC — All frontline personnel and items processing personal are instructed to notify a supervisor or officer when they hold an unusual check (i.e., in amount or in the location of the drawee bank) on a customer's account. High Risk Customers One of the key aspects of an effective anti-money laundering program is the identification of customers that may pose a higher risk to the bank and may need extensive monitoring. The account officers must identify high risk customers at account opening process and/or throughout the account relationship. A high-risk customer can also be identified or classified based on the totality of the circumstances, not just the type of business. High Risk customers may include regular customers, businesses, exempt customers, foreign customers or any other type of customers in the bank. Many factors will be taken in consideration to determine if a customer or business classified as "High Risk" should be closely monitored by the BSA Department. For example, a customer or a high-risk customer (business account) with frequent cash transactions (deposit or withdrawals), frequent wire transfers and cash intensive businesses may pose a higher risk needing additional monitoring than a business with no cash deposits or wire transfers. All high-risk accounts will be closely monitored by the BSA Department. Customers that create a higher risk will be placed in The BSA - High Risk Customer listing maintained by the BSA Department; the listing will be updated as necessary. High risk customers will be placed in this listing after a thorough analysis on the account, and not from a label affixed to the customer's operations. In addition, the line of business the customer is involved in, may not necessarily place them in The BSA- High Risk Customer Listing . Once the customer is identified as posing a higher risk for the Bank and needing additional monitoring, a file will be created and maintained for that customer for the duration of its status. Customers' activity is monitored closely utilizing a combination of system reports (i.e., currency transaction reports, wire transfer activity report, etc.). A review is performed periodically to determine if a customer shall remain under monitoring status. It is the responsibility of the BSA Officer to validate the frequency of account monitoring by reviewing the "high risk" customer's file and subsequently revising the frequency from time to time. In addition, the BSA Officer and the SAR Committee will determine whether an account should be closed, additional monitoring required, or a SAR completed. All officers should review the section on Customer Due Diligence of this Program. This will ensure the officer has obtained all the necessary documents on file for "High Risk Customers". Note: High Risk Accounts may include regular customers, businesses, exempt customer, foreign customer, or any other type of customer in the bank. Please review the High-Risk Customer Listing. IX. Detecting Suspicious Activity – “RED FLAGS” It is important to follow proper procedures and know how to detect and report suspicious activity. Law enforcement agencies review suspicious activity reports (SAR) filed by banks to detect money laundering and other illegal acts. Although you will not actually prepare the SAR form, you should know some of the red flags for illegal activity that would prompt you to notify your supervisor or the BSA officer, who will decide whether to file an SAR.

Suspicious financial transactions that the Bank must report include those: • Suspected by your Bank to involve funds derived from illicit activities.

For Training Purposes Only

Page 9

• Conducted for the purpose of hiding or disguising funds from illicit activity. • Suspected of violating the federal money laundering statutes in any way. • Potentially designed to evade the reporting or recordkeeping requirements of the Bank Secrecy Act. • Believed by the Bank to be suspicious for any other reason. Note: If any bank employee becomes aware of or suspects criminal activity by either bank customers or employees, he or she should promptly report the matter to the BSA Officer. Structure Transactions It is illegal for any person to structure transactions with the Bank to evade the reporting requirement. It is also illegal for any employee to assist another person in structuring transactions to evade the reporting requirement. Therefore, no employee of the Bank should assist a person in structuring transactions to avoid a CTR. If a Bank employee suspects that person is structuring cash transactions to evade the reporting requirement of the BSA, the employee they will report his or her suspicious to the BSA Officer. Note: If a currency transaction exceeds $10,000 and is suspicious, the Bank will file both a CTR and SAR. If a currency transaction equals, or is below $10,000 but is suspicious, the Bank will file only a SAR. Identifiable Areas of Vulnerability that the Bank should be aware of, include: • Structured currency deposits to individual DDA, often well below the typical levels for structuring, with multiple daily deposits to multiple accounts of the same day. • Consumers' checking accounts that are used for a period of time and then become dormant. In some cases, the accounts may be overdrawn, perhaps as a further means of avoiding detection. • Personal checking accounts opened by foreign nationals who come to the bank together. • Multiple accounts opened on the same day or held by the same foreign nationals at various banks. • Increased in the frequency or amounts of currency deposits made by US business accounts holders who export to countries who have lenient money laundering laws. Note: If a Bank employee believes that a transaction or a series of transactions in currency are suspicious or questionable, they are to inform their supervisor immediately - regardless if the currency amount is over or under $10,000. If the BSA Officer deems the situation worthy, a "Suspicious Activity Report" (SAR) covering the specific transaction that triggered the suspicion will be completed. General "Red Flags" for Suspicious Activity • Any customer who attempts to structure a transaction to avoid reporting under the BSA. • A significant change in the cash transaction pattern (higher or lower). • For business accounts, several changes in ownership or control in a short period of time (less than one year). • A business (check casher) that begins to deposit an unusual amount of cash. Unless the business is closing, a check casher will be requesting large amounts of cash and depositing checks. The BSA officer must be contacted immediately since this account may be a Money Service Business that requires additional account information to maintain compliance. • A customer, after becoming aware that a report may be filed because identifying information has been requested, declines to follow through with a transaction which has already been initiated. • Consumers' checking accounts that are used for a period of time and then become dormant. In some cases, the accounts may be overdrawn, perhaps as a further means of avoiding detection.

For Training Purposes Only

Page 10