Am trying to get some opinions on whether the group thinks it's acceptable for a third-party vendor to require the signing of a contract which states the customer (bank) will provide the third-party vendor a copy of their BSA/AML Policy/Program upon request and/or allow them (the third-party vendor) to come on-site to view such policy/program anytime they wish. My thoughts are that this is proprietary information and the bank should only need to certify that such information is in place and that it is abiding by all the applicable laws/regulations. Thoughts???? Would appreciate some insite on this. I'm being challenged!

Maybe you could speak to the 3rd-party vendor's compliance person? It sounds like this could just be the vendor doing C.Y.A. with no intention of actually reviewing the material.

What type of third party vendor is this?

This is another financial institution. Even though this is obviously their attempt to CYA and more than likely this will never happen, signing a contract binds the two parties and regardless of whether they will ever request this leaves it open and gives them the authority to do so.

We had a similar situation with a firm that provided foreign currency draft services to us. They sent us a very detailed questionnaire to complete and wanted copies of our BSA/AML policies. I argued loudly with them but it didn't matter. I told them that it made no sense for us to have to provide such detailed information because we are a US Bank subject to Federal Regulations, under the supervision of FDIC, have annual BSA exams, and we wouldn't be in business if we didn't have a sound BSA Program.

Fortunately, it ended up that we were in the process of switching sevice providers so I didn't have to provide the information. But someone else will probably ask for it...

I requested a 3rd party to certify that they have a BSA/AML program and an independent audit every year. They didn't have any problem doing so on their letter head, signed by the BSA Officer.

We use a 3rd party for gift cards/travel cards.

I would have gladly certified that we have a program in place. I even invited them to come to my office if they wanted to see our program, but they wanted much more than that. Here are a couple of the 17 questions they asked.

Identify the laws and regulations dealing with the issues of AML and KYC. Identify the entities involved in reporting, enforcement, and supervison.

Describe your regulatory reporting requirements for suspicious account activity and for large cash transactions.

Please describe the national laws and regulations governing disclosing client information to third parties.

And then we had to provide copies of our policies.

I just thought that was a bit much.

You have to be kidding right. Sounds like the basis for a doctoral thesis.

Wow... maybe they are wanting to copy your information for their own policies? at any rate, we provide a sample of our BSA/AML Policy that we have shortened for the TSPs. we removed any hint of procedures in our policies and made it very generic. our BSA program touches on the first two items you listed, but not the third one.... looks like they are wanting a copy of your GLBA program with this statement - Please describe the national laws and regulations governing disclosing client information to third parties.