Is a bank required to obtain copies of a registered MSB's BSA/AML Policy and proof of independent testing/audits? If so, do we need to get new copies of the testing every year?

Thanks!

No, that was tacitly required by FDIC examination procedures, but they were supersceded in 2005. Per guidance issued at that time, your bank should perform a risk rating for every MSB and assign them a level of risk based on that evaluation. The risk level you assign should drive the level of monitoring you impose and the documentation you require.

However, review your bank's policies and procedures for such requirements. It they are there, that is the equivalent of law or regulation within the 4 walls of your bank. Then, the answer would be "Yes," you must do it.

Great! Thanks for the help!

I've been asked (by our auditor) if we need to get some sort of letter from the MSB attesting to the fact that they DO NOT derive more than 50% of their income from MSB activities. Is this usually done? The customer in question is a grocery store (part of a chain that is registered) who cashes checks, sells money orders and performs Western Union transfers.

In working with a number of MSBs, it was not even mentioned by auditors or examiners that we should request some sort of letter stating what was mentioned in your post, Doug. I would start by asking what guidance or regulation suggested that should be done and to what purpose. If the grocery store is simply an agent for Western Union, they don't even have to register as an MSB unless they go over the $1,000 per day per person limit. In that case, I would question the auditor as to the logic behind their request.

I think the auditor was just wondering if this would help ensure that we've done enough 'due diligence' so that an examiner would not question our analysis. The grocery store is part of a chain, and the chain registered as an MSB listing those activities, in which every one of their stores engage. I don't believe they are anywhere near the 50% range, but I think the auditor just asked out of cautiousness.

The issue of whether the customer is an MSB can be determined by just a few transactions. The only time that your bank would actually need to know what percentage of their income is derived from that activity is if you were considering recognizing them as an exempt person.

Otherwise, it's not really relevant to anything...