I currently read a thread regarding Risk profiling... I am the Assistant BSA at my bank and I am responsible for profiling all our accounts with Risk Codes.. Under the new examination manual there is nothing saying HOW to this correctly.. So my question is, Does any bank out there have more than Low, Moderate, High riska cause I am in the process of having 3 high risk codes, 1 moderate risk code, and 2 low codes. I went to a seminar and the instructor thought it was going overboard but IMO the more you have the better it is to decide who you have to monitor and when... Any input would be appreciated.. Just want to know what other banks are doing?? :smirk:

I only use low, moderate, high, but I rate each account with a numerical value based on things like: transactions, have they had a SAR filed on them, etc. These numerical ratings range from (3) to 15, so I end up with somewhat low, somewhat moderate, somewhat high accounts, based on their numerical value. So I closely monitor my high risk accounts and I review annually those accounts that were rated moderate, but their numerical rating was on the threshold of high (in case they are now considered high).

I hope this makes sense, it's hard to explain it in writing.

I understand to a degree as to what you are saying.. We too rate each account with a numerical value 10,20,30-33 low, moderate, high... Determining which risk to put them in is becoming a hassle because this is still so new to me ... having never been in the banking industry before. I am only the BSA Assistant, have atteneded a seminar already but it seems like they want you to make a whole graph system and reasoning why you risk the accounts that #. SAR and CTR filings is a great factor what else should we be looking for?? Also are you doing every account or just business acounts?? Tanks for your reply..I appreciate the help!!

Some of the factors I use include: nature of business (is it one of the "high risk" businesses identified by regulators including MSB); length of relationship (under one year, 1-5 yrs, over 5 years); type of relationship (single account vs. multiple account relationship); US citizen vs. alien (PEP takes you to extreme rating requiring senior management approval); wire transfer activity (domestic vs. international, repetitive vs. walk-in); location(s) of business (HIDTA or HIFCA); criminal subpoena received; qualification for CTR exemption (Phase I less risk, cash intensive non-exemptible business is higher risk). I'm still working on the weighting scale. That has been the trickiest part to me.

Just a side question BrendaC, how are you checking for PEP status? We have been casting about on this issue and haven't come up with a good answer. Thanks for any info.

I don't know how to manage the risk assessment process outside of a true weighting and rating grid. We have ten banks in three states that will be using whatever form I finally decide on (so far I've designed several forms that I ended up filing in File 13 and now I'm starting over again). I have to provide a consistent way throughout our organhization to manage this task. I think I am just going to have to weight the major risk factors so much higher than the rest that they will have to kick out as high or extreme risk.

One of the aspects of the form is how to handle the obvious high risk entities. For example, a money service business is high risk, we all know that. If we have banked a particular MSB for 20 years and have a good relationship with the entity as well as the company principals (multiple acct relationships), we have exempted them, we document a formal on-site visit annually, and we have never detected any type of suspicious activity, are we safe to lower the risk rating to moderate or low based on these other factors--or should we always consider the MSB to be high risk? Based on our risk analysis, I think we can lower the rating, but I don't want to be left hanging out to dry at our next exam! It would easier to automatically code all of the "high risk" entities on the regulators list as high and move one, but that isn't a true risk assessment.

One thing you might do is use the rating system to show your risk management approach. For example:

The Insta-$ MSB account.
Being an MSB - 50 points (just an example)
*20 year history subtract 5 points
*annual site visit subtract 2 points
*AML-Policy on file subtract 2 points
*single cash account subtract 5 points (I probably phrased that badly)

And so on. On the plus side; you recognize the high risk account *and* the steps you've taken to ameliorate the risk. On the minus side, it may be a bear on the data collection side.

What monitoring system are you currently using to monitor these accounts. It is taking me forever to monitor these accounts while keeping my eyeballs from popping out of my head!!! All the acct#s start to run together after a while so i was curious what everyone is doing?

And our E.A. said risking business accounts are the only accounts we should be risking unless we come across DDA or SAV that have wire activity or sars filed on them.. Any opinions?

for our MSB we get a AML policy... i was under the impression those where the only types of accounts required to have a written AML policy... For business account customer , no we do not say "you are in the high risk catergory" we ask the type of services they offer if it a a business name not pertaining to the service type like for example.. XYZ Inc. << they do what type of busines?? But Tiling by ?? < obviously that is a tiling company 9 times out of ten that is their true nature of business. It is a difficult process this risking stuff. We have oly risked our Business DDA & SAV account and a few personal because of activity but the monitoring process is what has me stumped!!