Introductory BSA/AML Examiner School, Atlanta, CA

Bank of Smithville USA

Page 14

Appendix C Detailed Supporting Comments The BSA Compliance Program requires additional attention, with particular emphasis on the systems of internal controls and staffing resources. Independent Review The most recent audit was performed by Protiviti Consulting covered the period of January 1, 20XX through February 28, 20XX. The review appears to provide fairly comprehensive coverage and detected a number of significant deficiencies, resulting in an overall “unsatisfactory” rating. The audit identified seven significant, two moderate, and three low level findings. Of the issues considered significant, the review revealed that three (training, the Customer Identification Program (CIP), and Money Service Business (MSB) controls) have been addressed. The remaining significant issues that require additional attention include the untimely filing of SARs, staffing shortages, the backlogs of alerts and cases, and the EDD program. These issues are addressed in various sections below. Internal Controls Enhancements to the internal control structure are needed. Acquisitions through merger, conversion to a new automated monitoring system, and lack of personnel resources have resulted in program weaknesses discussed in detail below. Backlog of Verafin Alerts and Cases This issue was addressed in the audit and a subsequent April 20XX regulatory visitation, which reflected alert and case backlogs of 4,309 and 1,917, respectively. Management was utilizing four contractors from Dominion Advisory Group (Dominion) to address the alert backlog and addressed the case backlog by contracting on May 12, 20XX with AML RightSource, Cleveland, Ohio to assist with the review of cases, with work commencing in early June 20XX. The alert backlog has been eliminated; however, the movement to cases increased the backlog to 2,208 as of the target review, with over 150 of these originated prior to February 20XX. At the time of the exit meeting, additional progress had reduced the case backlog down to approximately 1,440 cases. The backlogs produced timing issues relating to the submission of SARs. In most instances, the research preformed for the alert produced sufficient detail to determine whether or not a SAR was necessary. In these situations, once the alert was transferred to a case, the 30-day filing timeframe should have begun, because there was a clear indication that the activity should be reported. The SARs were often not filed until four or five months following the initiation of the case, resulting in a systemic apparent violation for untimely submission of SARs.