What is the expectations from regulators when it comes to performing enhanced due diligence on High Risk products. For example, do we complete EDD on all customers that have an electronic banking product, or do we complete EDD only on the customers that are considered having a medium/high risk rating based on their activity within the product?

It is very interesting that you post this question, as recently we had an auditor who is clearly confused with the terms ‘high risk customer' and 'high risk businesses'. The auditor is stating that we should do EDD on all high risk businesses. We say no- our AML/BSA automated systems review transactions, and only the highest risk customers are reviewed each month in peer group analysis, and then semi-annually during risk reviews. For instance, they are suggesting a site visit for all high risk businesses, a review of financials, and validation of good standing with state. This seems over the top- I'd be interested in others opinions.

Not knowing your individual bank risk profiles, it is pretty hard to say what is or is not sufficient when it comes to managing the risks associated with your higher risk customers. It is not a one size fits all.

You need to be concerned about your auditor's education. They went a long way in attempting to eliminate the idea that any business was inherently "high risk" and making it plain that it was the bank's responsibility to identify its high risk customers. You do have a responsibility to identify and evaluate what the examination manual describes and lists as "customers subject to examination overview."

We have peer group analysis on all potentially high risk businesses-aka cash intensive businesses such as auto dealers, liquor stores, parking garages, convenience, jeweler stores etc.- we have that all covered and more. The issue I have is that the auditor is stating we need to review all auto dealers, outside the BSA/AML system- which I firmly disagree with. And to top it off, if they found neglect, then I'd be willing to say we missed something, and that we needed to improve/enhance our program- but that is not what they found. What they found was that we did enhanced due diligence on customers with Privately Owned ATMs, and they want a similar (maunal) review of other high risk businesses. But the only reason we are doing 'manual' reviews of POATM customers, is that our automated systems don't adequately cover all basis, as some these customers have thier 'operating' accounts -that feed the ATMs at other banks.

As far as peer group analysis, from what I have seen, unless you have a large population of similar customers, there is no statistical basis for the results that are generated (I assume I know the AML software that you are using) and it is basically a waste of time.

As far as your auditor recommendations, they clearly don't understand the requirements or concepts surrounding the monitoring of high risk customers and you might want to look for new auditors.

The software is very good- our peer group analysis is valid as we have high concentrations of businesses in the same categories.

We've been displeased with many audit firms, we've changed three times- it is difficult to retain qualified auditors these days.