Time to Dust Off and Update Your BSA and OFAC Risk Assessment
Time to Dust Off and Update Your BSA and OFAC Risk Assessment!
As children starting the arduous process of composing their wish list for Santa, many financial institutions are making and preparing and receiving lists for their own end-of-year tradition – the regulatory exam. The examiner’s own “wish list” for your bank will have the usual requests for policies, transaction reports, and countless other items, but one of the most important items on this year’s list may be your institution’s BSA and OFAC risk assessment. With updates to the FFIEC BSA exam manual from earlier this year, examiners may be taking a deeper dive and you should make sure your assessment includes some key points:
- Identification of all pertinent risk factors – Have you included all products and services for consideration? Don’t forget to address online account opening, out-of-state customers, and cannabis-related customers.
- Adequate analysis of the risk factors specific to your institution – If you don’t have one already, you may consider complementing the assessment with a narrative to address how you arrived at your conclusions for each factor.
- Quantitative data – Identify transaction volumes by type and a breakdown of your high risk customer base by risk factor.
- Year-to-year comparison – A 2- or 3-year comparative analysis of transactional volumes, CTR and SAR filings, and high risk customers will assist in identifying trends specific to your institution.
The inclusion of sufficient quantitative data and the year-to-year comparison not only helps the examiners identify your institution’s higher risk areas while they develop their scope, it can serve as an analysis of whether your staffing levels remain commensurate with your risk profile and institution’s growth.
The strength of your risk assessment may drive the focus and breadth of your exam, so putting the time in now can save you time in the long run when there are more festive end-of-year things to anticipate!
For additional information contact the author at firstname.lastname@example.org.