We've had an audit where it was recommended that we review our convenience store customers, bars, etc to see if there's ACH activity that would indicate a privately owned ATM on the premises. I have no problem with that, we do have a couple of small stores that do have these ATM's on-site. What additional due diligence steps should I do? I've read the BSA exam manual on privately owned ATM's and ISO's etc but I'm still confused about this whole thing. Anyone have any insight?

PM me with your e-mail address and I'll send you our procedures.

Our institution recently had an exam and though the privately owned ATMs were identified and the accounts are being reviewed it wasn't part of the policy. It was considered in the enhanced due diligence section. Devsfan, I will me you with the my email for your procedures.

My question is, the BSA Manual indicates -- Reviewing corporate documentation, licenses, permits, contracts, or references, including the ATM transaction provider contract -- how far do you go with this and how does this affect the risk? Will they really give you this information?

Thanks

"My question is, the BSA Manual indicates -- Reviewing corporate documentation, licenses, permits, contracts, or references, including the ATM transaction provider contract -- how far do you go with this and how does this affect the risk? Will they really give you this information?"

We ask for all of that. If they do not give it to us, we close the account.

We request a copy of the agreement, try to do a site visit and then monitor the activity. This has passed regulatory muster so far.

We haven't seen anyone unwilling to provide copies of 3 months of ISO statements and a contract, where applicable. We rate them as higher risk if they have more than a handful of ATMs, and if the ATMs are located far away from our locations or our customer's locations, and if the ATMs are located in HIDTAs or other high-risk areas.

One customer thought to have one convenience store was discovered to be operating a dozen convenience stores, each with its own ATM, owned and operated by the customer. No problem with getting the documentation, though. The only one who was squirelly was one who suddenly had to change the name of his business (a year after opening his account) when we started asking questions about his ATM activity. I see some similar behavior with MSBs sometimes - you get them on the phone and ask about check-cashing, and all of the sudden, they don't know anything about check-cashing because they are in the process of selling the business to someone else from the same country.

On this topic, does anyone know anything about MetaBank in Storm Lake Iowa? Funds to a known private ATM account are being ACHed from here, and a search of ACHs reveal another customer receiving funds from/through the same bank, in patterns indicative of another potential, previously un-identified private ATM.

Is it possible that you could be seeing transactions relating to prepaid cards?

http://www.creditcardxpo.com/metabank-credit-cards.asp

Possible, I found that one too.

I would also like a copy of your ATM procedures. We just found out that we have 2 privately owned ATM's and we don't have any procedures nor are they included in our Risk assessment of products and services. What are the major concerns with privately owned ATM's? How do we know if an ISO is involved. I really appreciate the help.

Here is a link to the section of the BSA Manual that covers privately owned ATMs. It has some good information on the risks and mitigation of the risks.

Private ATMs

I've recently come across a privately owned ATM and am at a loss. Would you mind sharing your procedures with me as well?

Ditto - they would be helpful! Thanks

Same here, could I have a copy of the procedures?

Thanks

Pizza Queen,

Our policies follow along with Devsfan and Maytagman. A site visit is a definite along with copies of statements and contract. We did end up closing an account for a non-cooperative customer who we discovered had a private ATM in a casino (she never told us about this one) and did not want to provide documentation we requested. I would hesitate to offer services to a customer, as Maytagman said, whose ATMs are located far from their business locations.

I also just discovered that we have a long time cutomer (bar owner)that has an ATM. Recently they are requesting large amounts of cash (all $20's) We have not addressed this in our BSA Policy and was hoping that someone can offer some advice. Thanks

We have a few privately owned ATMs, that is, they purchase the machines and them set them out in all kinds of places: bars, hotel lobbies, malls, etc. they are rated (forever) high risk. Each month branch takes a total of cash outs and ACH ins. Should come close. If you see a major blip on one side but not the other that means some cash appeared and fell from the sky, and this would need an explanation. Also, a major blip in a non-blip time (for example, increased usage should be expected on holidays) that should prompt more questions. S&S had no problems with this. that being said, I hate these companies!

I assume that when you say branch monthly looks at cash out and ach transactions in - your customers have a seperate account for the ATM - Our customer has only one account and runs all transactions (Ex payroll,cash deposits) no ACH transaction - so not sure how I can monitor this - any suggestions?

The same with our customer. So it is hard to determine what is happening because of the ATM and what is the normal course of business.

I would like to reopen this discussion. Doesn't anyone consider this to be overreaching on the part of FinCEN? Why should banks, simply because they have a loan relationship or deposit relationship with an entity that has an ATM onsite be responsible for monitoring the activity of that ATM?! I can see it if we are supplying cash for the ATM, but just because an ATM is on their premises does NOT mean we have to play investigator and policeman on it. Let the feds pressure the states to require licensing and inspection of those ATMs. I swear, if we don't start saying "no" on occassion, we're all going to regret it.

I personally think that much of what we do in the investigative arena qualifies as "over reaching". But that is now our reality. Obviously, the primary goal of monitoring ATM operations is to ensure that they are not being used to launder ill gotten gains. We need to understand where the money being loaded into our customer's machine is coming from if it isn't coming from us. And is the money they are withdrawing from us really being used for ATM purposes. Pretty consistent with the other cash flow monitoring we are required to do. And actually it is a necessary piece of the cash flow puzzle for a multi-faceted, cash intensive business.

It's called job security and today I am thankful for that!

I agree with your conclusion, but will not put the fault at FinCEN's feet. They are a co-author of the Handbook, but each of the five families also participates in the development process.

The historical precdent is MSBs. Initially, the FDIC's examination procedures made their supervised institutions the de facto regulatory agency for MSBs. They never anticipated the backlash; i.e. that banks would simply say "We're not doing that" and summarily close MSB accounts.

Retread acknowledges that "no documentation, no account" is a policy his bank is willing to enforce. As for me, I agree. I would follow every Mickey Mouse suggestion my regulator offers, but I'm passing every dime of the cost on to the customer; e.g. "If you provide financial services, whether it is cashing checks or offering an ATM, here's your fee schedule."

Is the question meant to ask if the ATM activity does not touch the institution, should there be any monitoring performed?

In my opinion, if we get the ACH credits OR see the cash withdrawals (preferably both, obviously), then most definitely we should be aware if the cash flow is not as it would be expected. The only way to know that is to investigate/monitor to make sure that it is.

I think if the ATM money is flowing completely through another institutions, aside from wondering why we don't have the entire relationship, it is still a piece of information I would want to know about. Knowing all services offered by one of our customers is vital information not only in BSA land, but in other areas of the institution also. I don't think I would give the account the same depth of review as the businesses that have ATMs that are serviced through an account here, however knowing that they have an ATM on the premises would give me enough cause to be aware of the activity in the relationship 'just in case'.

All this "job security" is going to send me to an early grave...where's the "plus" in that?