We're in our BSA Exam and the new guidance is being used on us. The examiner is saying that the bank "Must" keep the ofac verfication for five years to prove we ran it. What I want to know is the law. Is there a law requiring the bank to keep photocopies of our ofac findings for five years. I have read the guidance and on pages 30-35, the guidance points out that there are currrenlty no official government "lists" and CIP does not require you to keep any photocopies of any documentation, but only to record the method(s) used to identify your customer. The examiner is also saying that the bank should CIP existing customers when we already have established in policy that for existing customers, the bank has a reasonable basis for knowing the true identity of the customere, CIP would not apply, only to new customers. I'm trying to diffentiate from guidance and law. I don't mind being cited for violations of law, but don't feel I should be cited for recommendations made. Also, they want us to scan all our ofac checks into a database to be kept for five years!! Please help the sharks are getting hungry.

Keep in mind that CIP and OFAC are two different things, with different requirements. Also, truthfully, an OFAC database probably is a reasonable recommendation.

Im not sure what "ofac verification" is. Is that the document, like a wire, that they want you to keep for 5 years to prove you got approval that it was ok? Or is it the list from the government? Whenever the government sends a new list we overwrite our existing list so that there is no old history to show anyone, but a whole new updated list.

We use Thomspon Financial FactFilter to test names against the OFAC list. Ofac verfication is a short printout showing that the name is not an ofac problem. We are being asked to keep this document for five years. My question, is that the law or is it just their recommendation.

I hope you're not a fed bank - I'm expecting them in two weeks.
Our system does a printout of OFAC suspects at each update, about 60 pages, that we have to clear and so far, no matches. We were told to keep the reports for 60 days and it hasn't been a problem with the examiners. As we open new accounts and if an OFAC suspect comes up, we print the screen, clear it, and scan into the customer's CIF.
One of the items on our exam request list is to explain our rationale for exempting existing customers from CIP. We have exempted them based on a long history of a satisfactory accounts and mailing statements without them being returned, which were some of the reasons that the Q&A stated were acceptable. Good luck on your exam.

Anon #393646,

You are on the right track, but I'm a bit concerned over your examiner.

1) OFAC checks are a function of risk management, not a legal requirement. You should be in a position to show when and how you check the list and your examiner should be able to verify that such checks take place. OFAC checking is not connected to CIP requirements, including those related to record retention.

2) You were allowed to exempt existing customers opening new accounts from CIP in your written program. The examination procedures clearly acknowledge that by asking you to state what your rationale was for doing so.

The examination procedures are consistent with the law and regulation. Your examiner's statements are not. Please sit down with him or her, discuss your readings to date and ask whether you are getting advice or direction regarding these issues. If it's the latter, you will need to make it plain that you will disagree and ask that your objections be noted in the exit conference.