There is a prior thread with a significant amount of speculation, but it seems that this issue has "matured."

The OCC has distributed a "BSA/AML Quantity of Risk Summary Form" and a pamphlet "Money Laundering Risk System" with instructions on how to complete the form. National banks are to complete the form annually, reporting information as of 9/30 for the previous 12 months. The form is 11 pages long.

National banks need to evaluate this new requirement and develop a practical response. They also need to decide if a political response; i.e. contacting the ABA and their state bankers association is appropriate. David provided the ABA’s contact information in the prior thread. (Any bank that doesn’t complain there certainly doesn’t need to complain here.)

As for the practical response, the first positive comment is that national banks now have some idea as to what their regulator expects to see in their risk assessment. (The form being distributed is derived from, but not identical, to the two linked previously; do not use the versions linked in the prior threads.) Mentally completing the form for an imaginary bank is an interesting exercise. Major portions of the form are completely irrelevant to small banks with entirely domestic operations; their most common answers will be "none" and "$0".

Most of the time banks with solely domestic operations will spend completing the form will be in attempting to calculate reasonably representative dollar figures; e.g. the average daily ACH activity in terms of the number of transactions and dollar volume between 10/1/04 and 9/30/05. Estimates (which are permitted) will be essential in some areas.

The second positive comment is that the required use of the form provides a logical suggestion for when the risk assessment should be updated: shortly after 9/30 each year. If the OCC is going to use this information to evaluate the bank’s risk then the bank should use the same data as the foundation for its own evaluation. Timing the bank’s annual review of its risk assessment to coincide with the availability of this information simply makes good sense. (Completing the form is not the equivalent of doing the risk assessment described in the revised examination procedures.)

Obviously, banks should maintain workpapers showing where their information came from. I would suggest that documentation should show that estimates were extrapolated from facts, not just pulled from the air. National banks' BSA procedures and, to a lesser extent, their BSA policies should address the new compliance responsibility.

The OCC does not see this as a departure from the very recently homogenized examination process. OCC personnel believe they are providing guidance (which many banks requested) on the risk assessment process and a valuable tool for national banks to use. Personally, my greatest disappointment is that the OCC intentionally sidestepped the opportunity to obtain advance comment from all of its supervised institutions on both the form and the value of the information collected. There would have been much to say.

Ken, although we are not regulated by the OCC, I think that this document will be very useful.

As always, you are a great help.

Ken, thanks for the insight. Had they sought comment, there'd been plenty said. I might have suggested that the MLR has value ONE TIME, so the OCC could initially risk rate its client banks for exam planning purposes. After that, the examiners themselves should update their MLR database from data in OUR risk assessments during later exams. Relieve us of the ongoing burden. I think I did a pretty good job of doing our risk assessment without the aid of the MLR. They didn't seek comment, so I think the horse has left the barn on this one.

Here's an update from the ABA's "Money Laundering and Terrorism Issues Update" (a weekly e-newsletter), dated 12/16/05:

Update on OCC's Money Laundering Risk System

On December 9, 2005 OCC published in the Federal Register a notice that it has sent the Money Laundering Risk Assessment information collection to OMB for review and approval. This creates another opportunity for you to comment. Comments are due January 9, 2006.

As recited by the Supporting Statement to the BSA/AML Risk Assessment information collection (OMB Control No. 1557-0231), OCC has created the MLR System "to assist national bank examiners in measuring levels of risk in individual banks [and to] provide a more thorough and systematic method for examiners to assess a bank's risk profile, to determine examination scopes, and areas where expanded procedures and transaction testing may be needed."

OCC officials believe that collecting this information will also enable the agency to better assign examination resources among national banks based on risk.

The RSF consists of nine pages requiring numerical information on specific products and customer types, including number of retail transactions, dollars of retail transactions, number of accounts and outstanding balances. The data will be collected for each bank every 12 months. Community and mid-size banks will use the RSF, whereas the resident examiners of the 25 largest national banks are expected to have access to the same data from their assigned institutions.

Going forward ABA will be watching for answers to the following questions and asking for your experience with the MLR System:
Will OCC accept (without adverse criticism) bank risk assessments not predicated on the MLR System data or format?
Will OCC examiners differentiate among risk levels within product/customer groupings? E.g., According to the April 2005 Interagency Interpretive Guidance on MSBs, not all check cashers or money transmitters are high risk—yet the RSF makes no reporting distinction.
What will examiners require to “verify” bank estimated responses? What level of accuracy will be enforced? What will be the quality of information in the OCC database when it is an aggregation of actual data and estimated data from different reporting banks?
In the absence of data that distinguishes the relative risk of products or customers within particular categories, how will OCC describe risk levels based on aggregate data? Will OCC use the aggregate data internally, on an interagency basis, or in reports to Congress or other oversight bodies as a measure of industry BSA risk trends without distinguishing among risk levels within reported product/customer categories?
Will OCC generate peer group reports from the database, and if so, how will they be used by policy makers versus examiners?
Will the other agencies adopt data collection of the same or similar type, or does the OCC’s action represent a break from consistent Interagency exam procedures?
ABA is interested in your experience and encourages you to provide feedback on the MLR System and its impact on your OCC examination using our BSA Exam Questionnaire. [https://www.aba.com/aba/mem/gr_aml_form.htm]

At this point, no other agency requires this or any comparable data submission in connection with the Exam Manual or its oversight of BSA compliance. Although some discussion is occurring within those agencies about having a data submission requirement covering BSA, word from the Federal Reserve is that they have no current intentions to adopt such a mandatory risk data collection process or risk assessment form.

To discuss further, contact ABA’s Rich Riese [rriese@aba.com].

For the Federal Register notice, go here: http://a257.g.akamaitech.net/7/257/2422/01jan20051800/edocket.access.gpo.gov/2005/pdf/05-23822.pdf

For the Supporting Statement and other Paperwork Burden background, check this link:
http://www.aba.com/aba/documents/regulatory/RRR_OMBReq2005.doc

For the MLR System User Guide go to the BSA category of the Subject Resources page of the ABA Compliance Website or click on this link: http://www.aba.com/NR/rdonlyres/201ED198...ionGuidance.pdf
----------------------------------------------------------

Thanks, David. The ABA's approach is professional to say the least, but they clearly get it: the OCC initiative is a departure from the recently "standardized" approach to BSA examinations.

The ABA's questions also suggest something I believe to be true, these filings are just "number soup," they cannot support long distance evaluations. Moreover, they are predicated on the existence of the "high risk business” caste, a concept that the OCC initiated with its "list" several years ago, but something the new examination procedures abandoned altogether.

A meaningful opportunity to comment should have been offered before this started rolling downhill. Due to an “emergency” waiver sought by the OCC, the program was already in place before comments were sought in the September Federal Register notice. Only two comments were received in response to that notice, both from industry associations. As neither the September nor the current notice is accompanied by the MLR questionaire, it’s hard to understand how prior or current comments can be considered meaningful.

However, based on previous posts on BOL, the questionaire was in use long before the OCC asked the OMB permission for the waiver.

If you are curious why the OMB first waived your opportunity for comment due to "emergency" conditions preface your copy of the comment letter to them with:

If there are five federal functional regulatory agencies all charged with enforcing the same regulation, why is it an "emergency" that one of them be allowed to do something the others have no plans to do?

Copy Mr. Riese at the ABA with any formal comments you file. It would also be a good idea to let the BSA Mothership know what you think.

I absolutely believe in the comment process. However, when it's offered on an "after the fact" basis, it carries a patina of insincerity. In this instance, bankers may be more likely to get results from those to whom they send copies of their comments than from the entity to whom they are actually addressed.

The comment period ends January 9.