Deposit only customer. They lend money to folks to purchase homes and collect payments and payoffs when the people refinance to other lenders. The customer mentioned that they only do this for people that are known or are referrals. What types of implications would there be with banking this customer. They are offering financial services to folks which would mean they are a non-bank financial institution. My other thought is that they need to have a BSA/AML program and designated compliance officer to administer the program and ensure employees are trained. Any other pitfalls with banking this type of customer?

Let me quote some RLC at you. This was an answer about banking a third party debt collector, but I think it arguably applies to banking an NBFI/lender too:

"First question I would ask is why is this [new customer] sitting on my doorstep when we are not known for banking such high risk customers. There would be two answers that make sense. one - they are brand new or two - they just got kicked out of their old bank. Both present unacceptable risks even if you do normally bank these sorts of businesses."

https://www.bankersonline.com/forum/ubbthreads.php/topics/2246286/how-would-we-do-this#Post2246286

And if you don't normally bank these sorts of businesses, thus, you lack the knowledge and ability to effectively monitor them, why would you consider accepting them as a new customer?

Any time you're dealing with a business who provides financial services and wants to use your bank you need to be concerned about their AML and Sanctions programs. These relationships can be banked but I wouldn't go near it without knowing how much money you're going to make to offset the compliance costs.

Original ANON. I understand that these relationships can be difficult and complex. Where does one go to find the best information on how to get good at them? I don't think the customer that we are dealing with are very sophisticated and relatively low on a transactional scale. I know they will look at me cross-eyed when I tell them they are going to need a BSA/AML program with a designated compliance officer and training for their employees. That might make them leave anyway. But if they stay...what else would I have to do? Not only the ins and outs of EDD and that type of thing, but also how do you introduce and implement new types of businesses into your population. Where do you start with policy, assessment, board etc? Is there any guidance out there that navigates one from a bank that is somewhat vanilla to a bank that starts integrating some complexity?

So they are a private hard money lender. How large is their portfolio? Are they lending a total of $1MM of their own money or they have a large portfolio with outside investors? If they have outside investors, then your risks increase exponentially, as then they would need to know how their investors generated those investment funds. Are they doing this personally or under a business entity? The very least I would be looking for would be their balance sheet and income/expense statements before further consideration.

Original Anon- Thank you for providing those questions. The FFIEC BSA Examination manual does indicate that banks are not the de facto regulator, but what must we be looking for as far as red flags for this type of business. Are there any reputable resources that I can research and create some kind of framework around this type of customer?

Then one must also consider communications with senior management/board and policy implications. We have NBFIs addressed in our risk assessment which includes mitigating controls of CDD and EDD, ongoing monitoring etc, but would we go as far as letting the board or a committee of the board know that we have a customer of this type? Should board approval be obtained prior to onboarding a customer of this type? My thought is that this is a one-off situation and will not seek additional customers of this type.

Regarding some of the operational questions - I would not recommend going to the board for such minute operational matters. The Board approves your policy and if your policy permits it, it's a business decision to be made by the appropriate stakeholders. I would also avoid indicating it's a one time event. Who knows what the future holds? We would generally state something along the lines of each potential relationship would be reviewed on its individual merits.

Original Anon - Thank you for that input ACBbank. What you say makes sense to me for sure. Does anyone have any resources that they use to research and start building a framework around how to control risk around these types of customers? Obviously the first stop is the FFIEC BSA/AML Examination Manual. But anything else that anybody uses as a go to for this type of thing would be great! So far, this thread has been extremely helpful and I really appreciate it.

Just want to make a comment.
Any time the customer knows significantly more than the bank, it could be an issue. From the 2nd comment, the customer does not appear sophisticated, sometimes they play stupid to lull banks into a false sense of security. If they sought your bank out, it might be that they felt comfortable in being able to do what they wanted, without the bank being aware.

Don’t let a branch manager call the shots, there are risks and expenses (IMHO) involved, not just deposit growth.

Originally Posted by Anonymous
. But if they stay...what else would I have to do? Not only the ins and outs of EDD and that type of thing, but also how do you introduce and implement new types of businesses into your population. Where do you start with policy, assessment, board etc? Is there any guidance out there that navigates one from a bank that is somewhat vanilla to a bank that starts integrating some complexity?


these questions right here is what scares me. if you (and by "you" I mean your bank and the people whom work there) don't have the working knowledge of this and how to address, then reading on it so you can decide whether to allow a potential customer to do this or not is not a place you should be. if you don't know what to do, then you also don't know what not to do. and those 2 items combined put your bank at risk.

now, still want to proceed? then you need to find and hire someone who is knowledgeable of this type of business and how to bank them, including all the steps your bank needs to take. or find a consultant willing to come in and build this for you. (heck, quite a few of the BOL commenters and gurus are consultants, listen wisely to their words here)

We do not maintain relationships with customers we determine exceed our institution's risk appetite. Not having a program in place for that line of business - meaning a risk assessment was performed and due diligence requirements determined (periodic monitoring, documentation needed, etc) - would mean exiting that relationship or not entering it in the first place.

Regarding how to proceed forward - you may want to take a close look at Happy's post. If you want to move forward and you're not sure how, you may want to engage a professional for assistance. There are some good ones on BOL and you can always PM me and I can refer some that I have used in the past.