While teaching seminars in Kansas this week, I was surprised to hear that some regulators had told banks -- even small banks in small towns -- that manual methods for OFAC compliance were no longer sufficient and that the use of software was expected. In fact, one bank was told that the examiners would expect it to have implemented software before their next quarterly call.

Anybody else being told anything similar by your regulators?

Our new accounts supervisor attended a seminar yesterday on OFAC and was told it is "strongly recommended" by regulators that banks use software to check OFAC.

Well, our next OCC exam is scheduled for August and I have asked one of our examiners about OFAC software. He said for a bank our size that manual checking was OK and that they did not expect us to go out and buy expensive software. But WV is not exactly a hotbed of terrorist activity either.

Based on comments from seminar attendees, I have gotten the same feedback in Florida and the Rio Grande valley in Texas, but not in places like Tennessee and Nebraska. I would have placed Kansas in the latter group.

Examiners also comment favorably on the use of Chex Systems as an internal control for small banks, if the bank uses it for all new accounts rather than the dreaded, "...we only use it for people we are not comfortable with."

Most OFAC software I have seen checks "after the fact", that is, after the account has been established. (Ours "scrubs" the database each night.) Chex also may not notify the Bank until the following day. While this may not be a huge deal with deposit accounts, how are banks handling checking for OFAC on loans? Are you having the loan officer enter the person'sname into the screen on the ofac compliance web site? If there is a "hit", what are you putting in the Adverse Action letters? Are we required to give one in such instances?
Leslie

Mary Beth,

While I have not heard from our regulator that a software solution is mandatory, I have heard our primary compliance compliance examiner express skepticism that a "manual" solution can effectively ensure compliance.

Mary Beth,

Our regulator is the OTS and they highly suggested that we purchase OFAC Sofware. We are a small bank, $250 million in assets. They stated that using a manual system is impossible. So we purchased the Bridger OFAC software.

Pat Field
First Arizona Savings

OFAC software is like HMDA was some years ago. Reporting on paper was fine, but an electronic format was preferred. You didn't HAVE to spend the money for this, but in a letter to the President and/or board, I recall the discussion of civil money penalties if there were errors on paper submissions. And errors on paper were more common than errors in e-form.

I had to agree with them then, and I have to agree with them now. Basing a compliance program on paper copies of SDN lists is lip service and I would say ineffective if you have any volume at all.

So, while they can't say you must automate and spend the money, they are telling us to automate and spend the money.

Being in Kansas I was concerned after reading this post. I called the FDIC and a safety and soundness examiner told me that, at least in western Kansas, they are not "strongly recommending" software. They are waiting until the new BSA examination requirements come out. I told him that we are currently running all new account applications through ChexSystems and manually checking all current customers when the lists are updated. He said that this practice was sufficient for the time being.

Two more cents to add Mary Beth. I sent your note the first day it posted to my regulator, FRB-Richmond. They responded today. They are not requiring their supervised institutions to have software for OFAC/PATRIOT compliance. BTW, we are 5 offices, $150+ million.

TBerry stated:

"I told him that we are currently running all new account applications through ChexSystems and manually checking all current customers when the lists are updated."

How are you managing to check current customers to the updated OFAC list? I would hate to have that job!

Just wanted to add two cents to this discussion. I am preparing for a training session on OFAC for all employees. One thing a ran across was an OFAC training quiz from bankinfo.com and question #5 states:

OFAC REgulations require all banks to havea in place specific software for guarding against OFAC compliance violations. True or False

The answer: FALSE - While sofware is not required, it is often the best way to ensure compliance and OFAC considers the use of software a mitigating factor when assessing penalties when a violation does occur.

The fact that fines can be influenced by the presence of software makes me think twice about obtaining some sort of system.