I recently had an auditor note a finding/recommendation that we obtain anticipated activity at account opening as part of our EDD. The auditor said that it is required and quoted the EDD section of the BSA Exam Manual. My manual says "the bank SHOULD CONSIDER obtaining' the information. Has anyone else had this recommendation?

The recommendation was originally made but when I pointed out the same thing you noticed, the recommendation magically went away.

Randy and I put your auditor through the ringer pretty well for the CIP question. Before I do so again, I would point out that anticipated activity should fall under CDD, not EDD. Although CDD does not specifically state anticipated activity like EDD, the CDD section states, "The objective of CDD should be to enable the bank to predict with relative certainty the types of transactions in which a customer is likely to engage."

For business accounts, obtaining anticipated activity enables you to try and understand the normal and expected activity for the account and also assists in identifying higher risk customers. If I tell you at account opening that I am planning to sent on average $100k a month in international wire transfers or deposit $100k in cash, you may want to ask me some additional questions.

Anticipated activity for most consumer accounts will be the same so generally the questions we ask at account opening for consumer accounts may be less intense than a business. The list of documents in the enhanced due diligence section of the exam manual are items that we would ask of those higher risk customers that we identify, not all customers. The exam manual is pretty clear on this..."The bank may determine that a customer poses a higher risk because of the customer’s business activity, ownership structure, anticipated or actual volume and types of transactions, including those transactions involving higher-risk jurisdictions."

Am I asking all my customers for financial statements or performing site visits? No
Am I obtaining some type of benchmark statement of anticipated activity for all businesses so I can understand the "normal and expected activity, identify MSBs, privately owned ATMs, etc.?" Yes.

Thanks for your response!

Thank you for your response!

If you are talking about plain Jane deposit accounts owned by U.S. residents, you might want to point them to Appendix K in the exam manual also. Some general information is one thing, but EDD does not kick in until you go up the chart.

Good luck and look for another firm to do this next year.

Your auditor must be the sister/brother of our former external auditor. Every year she told us what "other banks are doing" as a yardstick. She learned this from a sharing session at a compliance group meeting that the firm attended. The banks mentioned were all major banks banks in a metro 100 miles away, not a small country bank in the bunch. She seemed to totally miss the fact that she was comparing grapefruit to oranges; it was all fruit to her and therefore, all the same.

This thread is bound to be "mined" over and over by bankers looking for a response to auditors and examiners who think the due diligence regulation means they are required to develop a unique profile for the most mundane of consumer customers.

They should note:
* the regulation says it is "risk based,"
* rlcarey's reference to Appendix K which has been in the Exam Manual for more than 10 years, and
* the following language from the preamble to the regulation:

We clarify first that our expectation that all accounts be subject to ongoing monitoring does not mean that we expect all accounts to be subject to a uniform level of scrutiny. Rather, we fully expect financial institutions to apply the risk-based approach in determining the level of monitoring to which each account will be subjected. Thus, consistent with current practice, we would expect the level of monitoring to vary across accounts based on the financial institution’s assessment of the risk associated with the customer and the account.