Good Morning,
I need to speak with anyone who uses GlobalVision's Patriot Officer AML system that are OCC regulated.

The OCC is telling me that we should run our High Risk customers against rules with LOWER thresholds - and I am trying to determine the best way to accomplish this within Patriot Officer but not create garbage / false positives!

Thanks - please message me here if can help!!

I am a previous PO user regulated by OCC and I had one of the toughest BSA Regulators there was. He never made that type of request and if he had I would have definitely asked he explain the need. He was also well versued in the rules so I would have requested his assistance in accomplishing the request.

Did they explain the purpose of this request and what they hoped to find?

Were they asking that you create a set of rules with lower parameters to filter the entire database with? If that is the case you can create rules, create the batch and then have Global Vision remove it once you have a chance to export the results. This keeps it from polluting your actual data you are reviewing and gives you data to review. This is how I ran new rules to test before I included them in the monthly runs.

Only a general observation: If a third party reviewer wants to give you specific advice on what produces an alert they should be able to point to something you missed. At most, agree to re-set your system temporarily to see if it turns up anything that justifies the amount of extra gravel you need to sift through to find a nugget. Tell him or that if there is no pay off, you will put it right back where it was.

This is simply not their job...

Ken - the OCC is not handling exams in that way. They issued an MRA (AND a violation) due to the fact we MAY be missing something since we don't have lower thesholds. It is assinine in nature in my opinion. Their way of raising the bar is to issue MRAs - even when they haven't found something you've missed.

Do you conduct periodic testing/validation of your rules/alerts to see if you are missing anything and need to adjust? If you have tested and can show that there is no value, that should end the discussion.

If you have no data to support your thresholds, it could be a tough conversation.

Yes we do - both tuning in the department as well as an outside consultant who did our model validation. I have argued to no avail - believe me. I know our system works - I have pointed out that they did not find anything we missed or overlooked - and they will not relent.

I sympathize. Been there in the past and sometimes there is no winning.

Make sure you document what your institution considers high risk. I'd caution against letting any risk scoring mechanism make a customer automatically high risk.

With that being said, we've done this with PO for certain "higher risk" customer types. Logistically, it's not that difficult if you have generally complete and accurate data. The important thing is to do some research to ensure you set appropriate thresholds.

As others have said, it may be useful to have an external auditor perform a data validation and possibly assist you with setting up the right rules.

If that's not in the budget, then you'll need to do the legwork yourself - which is beyond the scope of what Patriot Officer does within the program. If anyone in your department is tech-savvy enough to set up ODBC drivers and write SQL queries, have a go at it. Otherwise, you'll probably need your IT team involved.

Feel free to PM me for further details...

patsfan - I just sent you a message ! Thanks.

"Make sure you document what your institution considers high risk. I'd caution against letting any risk scoring mechanism make a customer automatically high risk."

We just received a similar recommendation from the audit firm that conducted our BSA audit. We use BAM and the criticism stemmed from customers that received additional points for a SAR filing, but their transactional activity was not high risk. These were SARs that were filed for an isolated incident of structuring.

I would be interested to hear how others are defining a high risk customer as I need to update our procedures.

The problem with the system assigning the risk is that some of them don't allow the risk to decrease at a future point. I do think a customer who had a SAR filed should be high risk for some period, but then if there is no recurrence and nothing else that indicates high risk, they should drop back.

And some systems, such as BAM, allow you to do that. It might be HIGH risk for the first 90 days (or whatever you code), but then starts to drop back down to Moderate or Low based on dates you provide and the number of 'points' you assign.

BAM & Verafin start dropping risk on SARs filed after a certain period of time. FCRM has different thresholds (lower) for HR customers - maybe that's where the OCC got it from? Regardless, I feel your pain. Some of the things they bring up are so above & beyond - it's really starting to make me question my profession.

I kind of want to be an OCC examiner so I can give all you guys a break & recommendations based on common sense!!

Well I hear they are going to be hiring soon, so there you go!