How are you approaching the task of identifying high-risk customers in your EXISTING customer base?

I thought we should have all branches review a listing of their customers so we can come up with a list of POTENTIAL high risk customers (based on listing of high risk businesses / countries provided by regulators), flag them as being in that category, then risk rate them.

Management wants to identify all MSBs, and then come up with a list of any other high risk customers that "come to mind" (because we think they might be a risk, not because they are an auto dealer, currency exchanger, etc), without having employees go through a list or structured process.

As a starting point, can the bank automatically exempt ALL existing customers who have been customers since a certain date, as long as they haven't raised any suspicion so far? Any thoughts?

We did it manually as well, the same way you mentioned. I wouldn't exempt anybody just because they were established. My guess is that their activity hasn't been reviewed...

So Devil Queen, if you identified 200 restaurants and 50 auto dealers, did you then do a risk assessment of each?

Also, how did you handle an auto dealer, or other high risk business that has loans only? I'm thinking that we should code the customer as being in the high-risk classification, but wouldn't have to actually perform a full risk assessment unless the customer engaged in other services (e.g. wires) or opened deposit accounts with the bank. What are your thoughts?

Yes, and it took 3 people 4 months to do, hence the creation of the "business account ID form" in the BOL tools, now we just add them onto the list, because I do not EVER want to do that again.

Re: auto dealers, IMHO, as long they have all of the correct ID docs for the loan; I would leave it alone, but, I would make sure that we are getting the "purpose" of the loan (BSA requirement) in very specific terms. Once the deposit account is opened... we would automatically place them in high risk and put them on the account review list.

I am sure someone else will chime in.

Which reminds me, where the heck is our automated AML software... IT Dept., please!!!!!

That's what I thought. By the way Devil Queen, may I ask what size bank you work for and if your regulator has already reviewed your risk assessment process? Just wondering if you had any guidance or received any input from them.

We might give our regulator a call just to make sure our risk assessment process meets their expectations.

2B, 25 branches----Last exam Jan-Feb 2005--- Yes, and we are still in business.

I have a very good examiner friend to whom I send a lot of stuff to for her to "just give a little input" on. I agree about sending it off to your regulator before your exam, if only for their input, and would also document the response you get.