We have a brand new examiner. He is writing us up for not listing our OFAC officer name or position in our policy. Our policy has been the same for many years. I asked him for a cite, and he provided an undated letter from Department of Treasury entitled, "A Framework for OFAC Compliance Commitments." The letter states that "these effort could generally be measured by" and then it lists appointing a dedicated OFAC officer. We have an OFAC officer, just not named in the policy. We aren't refusing to put the information in our policy, we just don't feel that it is worth a DOR especially since we can't verify the requirement exists. Any advice?

Do you have a named BSA Officer whose duties include OFAC compliance?

You never put names in a policy. If you do, then you need to go back to the board to have the policy amended every time there is a change in personnel. If your policy says there will be a OFAC officer appointed, then show them the appointment and move on.

Agree. I was (unartfully) trying to say that if you have a filled position for a BSA Officer whose duties include OFAC compliance, then you've met the substance of the requirement.

We've appointed both a BSA Officer and an OFAC officer - the OFAC officer has been our OFAC officer for the last 20 years, so I need a lot of luck finding where she was first appointed.

This examiner is very stubborn. He called us yesterday and wants a board meeting this afternoon since it is a DOR. Said he will write up another DOR if we don't have 100% attendance at the board meeting today. We already know several board members are out of town.

Fun times.

Piggy backing on Randy's comment. There is no requirement that a specific name or position be named in policy. OFAC doesn't even mandate that you have an OFAC Officer, but as a safety and soundness you should have one. Policy language can and should be generic. (e.g. "The Board will appoint a person responsible for OFAC Compliance.) would be adequate policy langauge.

This is what the Exam Manual says:

Responsible Individual
It is recommended that every bank designate a qualified individual(s) to be responsible for the day-to-day compliance of the OFAC compliance program, including changes or updates to the various sanctions programs, and the reporting of blocked or rejected transactions to OFAC and the oversight of blocked funds. This individual should have an appropriate level of knowledge about OFAC regulations commensurate with the bank's OFAC risk profile.

Does your Board renew appointments annually and are those documented in board minutes? That should satisfy the requirements.

Valley Girl, that examiner is way out of line. On the BSA/OFAC officer issues, you should point the examiner to 12 CFR 791, Appendix A, which includes the following:

"Examiners will not criticize (through the issuance of matters requiring attention, matters requiring immediate attention, matters requiring board attention, documents of resolution, and supervisory recommendations) a supervised financial institution for, and the NCUA will not issue an enforcement action on the basis of, a “violation” of or “non-compliance” with supervisory guidance."

An undated Treasury Department letter definitely qualifies as supervisory guidance (not regulation).

Is he / she the EIC?

Thank you rainman and Brian for your kind words!

I just came back to work after having been out with Covid, so I'm not at 100%, but I told my supervisor this morning that I felt it was kind of out of line to hit us with a DOR on "best practices" and asked if I could ask him for a citation since one was not listed on the report. I did ask him during our meeting this morning, in a nice way, but apparently he doesn't like to be questioned.

Update - after my CEO asked to speak to the department head, he has downgraded the DOR. We will still update our policy so as to avoid future problems. Thank goodness! I just got the email a moment ago.

It's also out of line for the examiner to threaten to add to the DOR for not having 100% attendance at an unscheduled board meeting called by the examiner with 24 hours notice the week after the July 4th holiday. Even though the examiner backed down on this one, I'd want the CEO to have a chat with the supervising examiner (above the EIC) about the unsatisfactory approach.

You might also have the Chairman of the Board on that call also. That examiner is off his rocker. I might even be writing a formal letter to the head of enforcement/examinations in DC (not sure of the title of your regulatory agency) and contact your ombudsman also.

These are the kind of people that need a good spanking by their superiors. Don't let them get away with this behavior or they will just get worse.

Appreciate the advice - I was just so floored by his response. Our CEO sat on the commission for several years, so when she told the examiner she was going to contact the commissioner, I think that adjusted the attitude very quickly. Our board is also aware of the dust up.

This may have been resolved already, but some additional thoughts. Your policy should never include a specific name for reasons already covered. Generally speaking your policy will state something along the lines of the BSA Officer/Head of AML/Chief Compliance Officer will be responsible for the day-to-day operations of the AML Department (Or something along those lines).

The meeting minutes of the Board (Or appropriate Board Committee) will designate a specific individual with the appropriate title, thus meeting the pillar requirement.

If that's the lone finding in the exam, it's time to open the scotch. That means they have nothing on you.

ACBank - you uncovered the source of the problem! The examiner got into the scotch.

Hopefully he left enough for Valley Girl.

I have held onto the scotch in anticipation of his return in 12 to 18 months.