If we open a new account and do beneficial owner, if the BO identified is already on our system do we need to check OFAC again? Our system is scrubbed weekly for OFAC by our core. We had an audit and if the BO was already on our system, we did not screen OFAC again but the auditor is stating that we need to at the time of account opening.

Everything OFAC is risk-based. If you justify in your OFAC Risk Assessment why this is not needed, then that is a risk-based decision.

Follow-up question: Do your perform an OFAC review of existing customers that open a new account? If no, then why does your auditor think the beneficial ownership process would be any different?

Follow-up question #2: If your audit is outsourced, is it time to evaluate other vendors for next year?

Thanks,

No, we do not perform OFAC on existing customers who names already appear in our core since its scrubbed weekly.

When I stated to her OFAC was risk based all she said was that the regulation just states at the time of account opening.

No they don't. There is no OFAC regulation government frequency or timing of searches. OFAC only prescribes penalties if your process a prohibited transaction. FinCEN's 2016 FAQs note that you can treat beneficial ownership information for screening the same way you do customer screening.

Question 23: Office of Foreign Assets Control (OFAC) Regulations
Q: Are covered financial institutions required to comply with the OFAC regulations with respect to beneficial ownership information?
A: Covered financial institutions should use beneficial ownership information as they use other information they gather regarding customers (e.g., through compliance with the CIP requirements), including for compliance with OFAC-administered sanctions.

Also see OFAC FAQs noting that OFAC only applies if the beneficial owner has 50% or more ownership interest. There is nothing here about who must be screened and when.

Your auditor is advocating busy work to check a box on a workpaper and you are right to question.

We had an audit and if the BO was already on our system, we did not screen OFAC again but the auditor is stating that we need to at the time of account opening.

Just wondering how long does it take to find that the BO was on the system vs. an OFAC screening?

What is written in policy in reference to BO and OFAC scan? (the real determination of what is correct in your situation)

Do want to trust if the employee hired yesterday and is opening his first account is going to get it right?

Our procedure is not to screen OFAC if the BO is already on the system.

As far as the time requirement, it would save a step. The first thing our new accounts do is look for name so we can get a Port number so they can plug that into the new account opening software so the account goes to where we want it. It saves a step. It not a huge time saving step.

I addressed this when I designed my CBO form. I have a box to check to indicate if the BO is an existing customer. If checked, no OFAC is required as our database is scanned nightly.

Ask her to show you where it requires that OFAC be checked at account opening. I've worked at banks that did as the other poster stated and OFAC was not checked until the nightly run. Any hits were addressed the next day by blocking the account.

If anything, they could make a process improvement recommendation for your consideration. But there is no violation here.

I encourage my clients to challenge me during audits.

Are your comments...

A Violation of Law or regulation?
Based on written guidance not codified?
Personal Opinion?
Something I saw at another bank I really liked?

Ask the auditor for a source for that statement. The only possibility is a citation to your bank's policies or procedures.

I am not a party to this and have no specific knowledge:

https://www.dfs.ny.gov/about/press/pr1810101.htm

Based upon what is written and not necessarily fact it appears that there is no specific transaction that was in violation of OFAC.

Thanks all for your input! She did say she won't put anything in her report as she's knows there is no citation.

I did argue with her that it risk based, etc. She stated examiners will expect that we check it at all times. I told her I'll have the conversation with an examiner!

told her I'll have the conversation with an examiner!

Good luck

I'd recommend reviewing the exam manual to think about what that conversation will look like. On page 147 it states "New accounts should be compared with the OFAC lists prior to being opened or shortly thereafter (e.g., during nightly processing)." Should is a loaded term and that's where I would see examiners finding justification for a finding, despite the fact that there is no regulatory requirement.

The only possible examiner criticism would be that the bank was taking an inordinate risk. If a bank's written OFAC risk assessment concludes otherwise, that would be the controlling judgement, not that of an individual examiner.

Banks are allowed and entitled to accept risks, particularly when they identify them and acknowledge their acceptance.