Can someone please direct me to where there is a list of high risk businesses in the Exam Manual?

There isn't one.

With the first publication of the Manual they changed their philosophy; i.e. it is up to each bank to establish its own list of high risk customers based on its own analysis. There is no business that automatically gets a high risk classification.

The manual does list customers "subject to expanded examination overview." They can and should be identified by every bank. Those customers should be the first analyzed to determine if they deserve a high risk classification, but not all of them will.

As Ken said, there isn't a list. Here's the section of the online manual that addresses risk assessment. http://www.ffiec.gov/bsa_aml_infobase/pages_manual/OLM_005.htm

With that being said, we have a list of businesses that we consider high risk and require enhanced due diligence. These accounts are coded when they are opened so BSA can do a back office review.

The businesses include: MSB/Check Cashers, Convenience Stores, Casinos/gaming establishments/card clubs, Non-profit/governmental agencies, car/boat/airplane dealerships, travel agencies, jewels/gems/precious metal dealers, import/export companies and real estate brokers/agents/management companies. We also look at professionals such as doctors and lawyers but do not code them as requiring enhanced due diligence.

That's pretty much what they do not want you to do...

Prior to my arrival at my current FI the OCC forced, yes, forced my FI to code all those types of businesses that NewToo mentioned as High Risk. I cannot count the number of hours’ wasted and false positives I had to deal with because of this "recommendation."

As Ken posted earlier, you're not required to code any one high risk from day one. Type of business is just one factor, which when examined with others, expected/actual activity, types of products/services needed by the customer, foreign vs. domestic activity, etc. which can lead to a high risk rating. This is all part of using a risk based approach. That is what the manual recommends.

NewTooBSA, what is your process for the employee opening the account to "code" them so that BSA can review? For example, is this done by the SIC or NAICS code?

Thanks!

We have a select list for employees to choose from (unfortunately we do not have NAICS or SIC code capability in our core system).

Examples:

A Attorney
ACCT Accountant
AG Agriculture / Farming
ATM ATM Provider
AUCT Auctioneer
AUTO Auto/Boat/Plane Dealer/Repair
C Construction Industry
CAR Car Wash
CHURC Church
CON Convenience Store/Gas Station


I can then pull queries from our core system to show me (for example): "All CIS records with "CON" in the profile code".


Also, all business risk assessment forms are forwarded to our BSA dept for review & we make sure the profile code matches.

PeeWee
Our core processor does not have a way to code accounts using the NAICS or SIC codes either. However they do have an account type field that we utilize with a 3 digit code.

Convenience/Liquor Stores = 301
Check Cashers = 401
Personal Accts = 101
All other high risk commercial = 201

Using that along with the occupation/business we are able to identify the types of businesses and why they are coded as high risk. This also allows us to identify these accounts for annual OCC reporting of the MLR by pulling accounts by account type and sorting by occupation/business.

And in answer to Ken's response: I know we are not "supposed" to make a list of high risk customers based on their business/occupations but it is the only solution we could come up with to identify the information required to be provided to the OCC. Because we also have automated AML software, these same customers are risk rated based on their activity and that is where the true monitoring takes place.