I am working on our OFAC Policy...

Background: We provide bill pay service for a third party payment processor but the transactions on our side are limited to payment exception items which are typically credit transactions being returned to the bill pay customer at their respective financial institution. While the transactions are scanned by our interdiction software, we have made the decision not to obtain information for any of these transactions if they trigger a potential OFAC match. I have documented the decision and reasons in my "OFAC Program Decisions" notebook.

Would you include reference to this in the OFAC Policy as well? And if so, do you have any suggestions on the best way to word it?

this appears to me to be an issue that is procedural in nature, not policy, so I would not include.

However, I may choose to include something in my policy that certain potential matches will not be reviewed. But as I wrote this, it makes me think I will now need to address with audit and regulators as to why I exclude every time they set foot in the bank, so maybe I wouldn't include.

That would be better addressed in your OFAC Risk Assessment. The OFAC risk for the refund of a credit from another domestic financial institution is, in my humble opinion, very low.

Thank you! I agree, Princess, which is why I made the decision that the extra work to attempt to contact the bill pay vendor and/or the receiving bank would outweigh the miniscule risk. I also agree that it doesn't belong the policy. I do have it outlined in the OFAC Risk Assessment in addition to my "notebook" so I think I'm good. Thank you for the feedback!

I have a question about how it is worded on who you will run OFACs for in your policy. We currently run an OFAC on every check that is wrote from our bank. This includes other banks, governmental bodies, domestic companies, the IRS. I am rewriting the policy and am looking to "exempt" some of these very low risk entities such as banks and the governmental bodies. Just want to get an idea on how to word this without calling out specific entities.

As the Princess indicates, decisions regarding when to do OFAC checks are best recited in procedures (per the findings in your risk assessment) not your policy. To be blunt, your board is not a source of expertise on this point and there is no reason to make them responsible for specific decisions. Nor do you want to go back to the board and ask for their consent to revise your pulse points.

I cannot comprehend how or why any bank could do an OFAC check on every single check issued against it... Either way, do not create "exemptions" because there is no requirement that you look at every possible instance. Just indicate the times when the list is to be checked and leave it to the reader to assume that it is not checked at any other times.

I'm sorry... I meant every check that we are writing to a vendor, etc. Not every check that a customer would write. But it is still very cumbersome and wastes a lot of time in my opinion. The current BSA policy includes high level details, procedures, etc. I'm trying to get away from that so I don't have to take the policy to the board when we say we're going to do a procedure a different way. Another waste of time...

We just got our internal audit findings and they mentioned the need to scan our vendors as well. It seems to be a hot topic these days.

We added all of our vendors in one CIF so that they are screened nighty for OFAC, just like all current customers.
No need to check OFAC each time you pay one.

Any time you can do something that is a profound waste of time in as little time as possible it's a great idea. Now, you just make certain that CIF is up to date.

Here is what continues to amaze me about OFAC. 20 years ago, almost NO ONE was checking OFAC for anything. Okay well maybe most folks knew they shouldn't open an account for someone in Cuba or Iran. But beyond that, even saying the acronym "OFAC" would earn you strange looks and perhaps a comment from HR to watch your language.

Flash forward to now when every 2-bit auditor or examiner feels the need to compel a bank to run "Boy Scout Troop 1023" against the OFAC list before sending a donation, and well.... the times they have changed.

Has the OFAC risk actually risen that much over the last 20 years? Not really. But our perception of that risk has.
_________________________

The risk of an examiner finding has grown by leaps and bounds

A slight risk increase in foreign wires has increased

if the risk of a person going into a branch to make a transaction or repair the water cooler has increased there is a bigger issue in this country than an OFAC violation

This was my suggestion when they asked me how to get away from that. Whether they did that or not is a different story.

The very first time I did an internet search of OFAC, I came up with Ontario Farm Animal Council. I also remember a seminar I attended many years ago where almost nobody had ever heard of OFAC. When told what it was by the presenter, Dennis Wood of OFAC, they thought it was something new.

My alma mater was delivering a proposal for a weeklong compliance school to the OTS in the early 90's. Our general counsel and I were meeting with their representative and as she turned to her credenza to get some documents she said, "Oh yeah, we would like for you to spend 30 minutes on OFAC." Our general counsel looked at me, knitted his brow and mouthed the term "OFAC?" I shrugged my shoulders and said for her ears "No problem."

Somewhere in the bowels of the Threads there is a quote from me that says if the amount banks spend on OFAC searches was transferred to the FBI's budget the practice would stop tomorrow. That's still true, perhaps even more so. It doesn't cost the government anything to require the banks to waste their time.

I'm new to the site- so I apologize in advance for my off subject yet on subject question.
Scenario: The same non-customer has been coming in religiously for the last two years, every Friday to cash his paycheck---- is it a requirement he be screened EVERY single time he comes in since the OFAC/SDN List is ever-changing? Is there any verbiage to back up the "yes" or "no" ?

No verbiage but what happens if the non-customer is put on to the list in between the last paycheck and todays pay.

We check the OFAC SDN/CON every time it is changed (you can 'subscribe' so that you are advised whenever a change occurs). It doesn't take that long and ensures that if someone was added, deleted or changed on the lists that we are aware of it.

To answer the question, there is no regulatory requirement to screen anyone at anytime. The only requirement is not to do business with them in violation of the OFAC provisions.