Presently, I perform the periodic OFAC scan each time the list has been updated. Q: Is it permissible to only perform the periodic scan when there have been additions to the OFAC list? Since BOL's OFAC page list the detail changes when the list is updated, it seems logical to only perform the scan for the existing customers when they have been additions.

Appreciate any feedback/guidance/criticisms......

I think most systems now do a nightly scan.
If you do not have an automatic scan in place, I think you run the risk of examiners questioning how you will remember to run the scan when updates are issued, i.e. what procedures are in place.

Is it permissible?
It is if your OFAC policy says so.
You decide that based on your risk.
OFAC only says that you cannot do business with anyone on the list.

The criticism could come into play when examiners see what other banks are doing, or what most banks are doing, and then maybe ask why you want to do it differently, and you would have to justify it.
If, based on your risk, you feel comfortable with your process and can defend it, then you should be okay.

We scan at account opening & each time the list is updated.

The examiners have been fine with that.

I don't see it being any different than running a scan every 2 weeks when the "other" list is sent out.

Have procedures & document it.

I don't see a big deal about scanning the portfolio only when the list changes. You might want to reference checking the OFAC site itself in the event there is a question like "what if BOL makes a mistake". (I didn't see any differences, but you know how examiners like to "what if".)

Since your scan is not automated, make sure you document how you find out the list was updated, how you ensure the batch is run within "x" period of the list being updated, who is the backup in the event you are not available, etc.

One thing that occurred to me recently while working on an OFAC risk assessment - what if someone adds someone to an account such as a convenience signer or a loan guarantor after account opening. Are they checked (assuming you normally check them at account opening? If they are not checked, you could have a delayed period until they are picked up by a batch scan since you don't run at a set frequency.

Naturally, your risk assessment must address this.

While it's theoretically driven by your risk assessment, examiner expectations are oftentimes driven by what they have seen in the last 10 banks they examined. If you are one of Magic City's neighbors; i.e. you're in Florida, nightly comparisons (looking for edits and changes in signatories not just additions to the list) are common.

Stick with the mantra that your decision is driven by your risk assessment, but call a couple peer banks and see what they do.

Is it of any value regardless of frequency? Different question.

One last comment, ease of scanning is a component in determining when you scan - at least for examiners. I am surprised by how many banks I am finding where IT doesn't just automatically run a scan that is automated to run in the middle of the night, it is left to BSA to start the scan via the AML software. It seems to be a backward step that came about because of the proliferation of AML software.

Our scan is run nightly but I only go in and check the report when there have been changes to the list.

Be sure to periodically verify your update process. I used to key in a new account with the name of one of the additions to the SDN list to ensure it came back as a test. I could then delete the new account.

On more than one occasion, I found errors in the update process which let the entry go undetected as a hit (we were a JHA bank). There is apparently a final step in the update process that IT sometimes overlooked.

Brenda is not advocating a technique based on an "excess of caution." Examiners expect banks to check the timeliness and accuracy of their vendor's update process. Leave a paper trail indicating you do it routinely.

We check OFAC at account opening and use ATTUS Technologies' Single Name Look-up feature for non-customer transactions. For the periodic scan (as the OFAC list is updated), we use ATTUS WatchDOG Pro; I subscribed to the Treasury's OFAC Updates so I'm alerted each time the list is updated. Our vendor (ATTUS) also sends an email when the list is updated (which is the same day I rec'd the OFAC alert email from the Treas.).

I'm just thinking out loud (that's dangerous) and wondering is it necessary to perform the scan when the updated list only reflect individual/entities removed from the OFAC list........

Like AnnRoy I have subscribed to the Treasury's OFAC Updates so I receive the alert when there has been a change to the list. I verify that our automated nightly scan has updated the list and initial the printout so my examiner can see the process.
In addition, each new account, all signers or anyone who has access to an account is OFAC scanned prior to the account/loan being opened.

I also get an email that there has been a change to the OFAC list. Patriot Officer automatically scans the 1st Sunday each month(that's what we have set) & overnight every time a list is updated. We can see the update in the morning & check to make sure we have no matches. We also scan at new account opening,issuing Cashiers checks, U S Savings Bonds & cash advances for non-customers.
We are in a very low risk area (Hallelujah!), so our examiners are ok with the scan frequency.