I recently joined a small financial institution as their BSA Officer. The individual that was in this position prior to me did not follow the record retention requirements outlined in the BSA examination manual. I am finding reports that should be reviewed on a weekly basis but there is no evidence of her review. Some dates are missing, some dates are printed multiple times. We do not use any kind of BSA/AML monitoring software, all reviews are done manually and SARs/CTRs are filed through FinCEN's website. The current practice is to keep a printed copy of every report I review / file for 5 years.

How would you handle gaps in retention? The BSA examination manual states 'maintain a record' - how do you interpret the definition of a record in this case?

You stated "I am finding reports that should have be reviewed on a weekly basis but there is no evidence of her review." Was this according to your Bank's Policies and Procedures?

My recommendation, identify the time period in which you think the activity was not reviewed and/or monitored and perform a scrub of the activity for this time period. You may start by sending a memo to your supervisor or the board for CYA purposes.

I am finding reports that should be reviewed on a weekly basis but there is no evidence of her review. Some dates are missing, some dates are printed multiple times. We do not use any kind of BSA/AML monitoring software, all reviews are done manually and SARs/CTRs are filed through FinCEN's website. The current practice is to keep a printed copy of every report I review / file for 5 years

Sorry to say but this is above a Records Retention issue.

Document and set an action plan.

Before we call it a "gap", which specific "reports" are you talking about? There's a big difference between retention requirements for "management reports" vs. "regulatory reports/records".

Based on the weekly reviews you've described as missing, it sounds like your problem is related to "management reports" or "workpapers" (for lack of a better term). Unless you dictate as much in your policy, there is no specific requirement to retain those for any amount of time. For example, if you review a daily large cash report to identify the need for CTRs, those are not directly required to be retained - only the CTRs are. I stress the term "directly" because your "workpaper" retention practices will be evaluated by examiners under the internal control pillar and a failure to adequately document your analysis and decisions will easily get you in hot water. The best practice I've seen tossed around, relative to "workpaper" retention, is to retain from exam-to-exam at a minimum. Maintaining five years of workpapers is not imprudent.

In your circumstance, it would be prudent to report the issue to a management oversight committee (e.g. risk, audit, etc.) and have a documented review that captures the scope of missing documentation, a manual lookback, identification of any control weaknesses, and a resolution to all of the problems you've identified.

It is what it is. Thankfully, the previous person was not in this position very long (several months) and once management realized that they made a mistake when hired that person they addressed it. Our situation is not the first instance in the history. I am looking for practical suggestions / advises about how to address this concern so that it does not cause issues in the future.

I document everything and send memos to my boss about what I found and how/when I started correcting the identified concern. I also include in those memos the compensating controls we have in place.