My bank currently runs all new account names and signers on all new accounts against the OFAC listing. Any changes to the authorized signers are also run against the OFAC listing. When the list is updated, a report is run against CIF records of existing accounts. We do NOT create a CIF record for a signer unless the signer is also a customer of the bank. Are we required to check authorized signers each time the list is updated? Thanks in advance for any help you can provide.

Once you have checked a name against OFAC, that's it - there is no requirement to re-check the name, just check any new names and entities as new accounts are opened. In other words, it's a one time deal.

On the other hand, the FBI Control List needs to be checked periodically against your database on an ongoing basis, not each time an account is opened.

Also, the OFAC list needs to be checked prior to opening a loan, if that name or entity has not opened another account that has been checked against OFAC. In addition, the recipients of outgoing wires need to be checked against OFAC.

This is my understanding of the requirements, based on an FDIC exam a few weeks ago.

I understood the requirement to be to check all customers against the list with each update because a name could be "fine" when the account is opened but be added to the OFAC list six months later. If a transaction isn't blocked when a name matches the list, it's on the institution.

I don't know any cites to back this up, so does anyone else have anything stronger than my "This is what I think"?

In reply to:

---

Once you have checked a name against OFAC, that's it - there is no requirement to re-check the name, just check any new names and entities as new accounts are opened. In other words, it's a one time deal.

---

True, there are no requirements to check the information periodically, but I believe you should.
What if an existing customer is added to the OFAC list? You could be in violation even if the name was OK six months ago. The customer file should be checked periodically as well as when the OFAC list changes.
Also, I think there is some confusion about the FBI Control List. Originally, we thought it was a one-time check, but I have been hearing otherwise recently.

I am also under the impression the customer base needs to be run against the list with each update. I am not sure how to check each signer against the list since we do not create a CIF record for signers on loans, deposit accounts, safe deposit boxes, etc.

Our system checks against the updated OFAC list nightly. You should periodically check against the list. You are prohibited from violating the OFAC laws. That means at any time. It's just too much of a risk not to.

Where is Andy when we need him????

Anyway, I just went through an FDIC exam and they were very comfortable with our checking the OFAC list at new accounts. Although I see your point, e.g., one of our customers could be added to the list after an account is opened, checking OFAC against the database is an expense we are trying to avoid at this time. The FBI control list(s) is relatively short, so it's not a problem to run through that list.

It sure seems like there should be a better way to handle this whole situation, like deportation. Why are all these people purportedly running around our country?

I would refer you to the recently releasede OFAC FAQ -

How often do I need to scan my customer database for SDNs?

The frequency of running an OFAC scan must be guided by your internal bank policy and procedures. Keep in mind, however, that if your bank fails to identify and block a target account (of a terrorist, for example), there could be "real world" consequences such as a transfer of funds or other valuable property to an SDN, an enforcement action against your bank, and negative publicity. [09-10-02]

I would say that they pretty much expect a database scrub on a periodic basis.

Our system also checks against the list daily. However, if a signer does NOT have a CIF record, there is nothing in the system to check against the list. (Does that make sense???) Do you create a record for each signer on every deposit account and/or loan???

In reply to:

---

Do you create a record for each signer on every deposit account and/or loan???

---

You should be. Especially on loans. Consumer loans will have ECOA requirements and if you are not listing them separately, how can you locate them and report them to the credit bureaus?

We create a CIF record for all owners of an account as well as all signers on consumer loans. However, we do NOT create a record for signers on commercial accounts or loans. Should we be doing this??

You might as well. You're going to have to create some type of file under the new CIP anyway.

Sounds like you were on top of things. But as noted, CIP will require some changes. I am not sure if you need to go back and change those, or if you can do so on a going forward basis. My suspicion is the former.

WOW, that's a real bummer, but sets the record straight. Thanks for the post.

By the way, what does periodic basis mean?

I'm looking for a minimum number, e.g. once a year, twice a year with once a year preferable since each new name is checked at new accounts? Have you seen anything on the meaning of "periodic basis." My bank is basically out in the middle of nowhere, so if there is no actually interpretation, e.g. "number of times per _____," etc., how does once a year sound in a low risk environment, since risk may be the only variable to consider?

V2 -

You said that the regulators were just there and they were fine with checking the OFAC list only on account set up. From personal experience, I wouldn't count on an examiner's opinion to protect me on an issue of partial compliance. As an example, the FDIC examiners recently finished their exam of our institution. I am the BSA Officer (among other positions) and they didn't say "Boo" about BSA. We don't check the OFAC list, we don't capture TINs...there are several things we don't do. Management feels the risk is minimal or that the requirements don't apply to us. The examiners didn't ask the questions they should have, and management feels vindicated and says, "If they didn't ask, then it isn't a big deal. Now go away."

Anyway, just because one examiner said it was ok (or was too incompetant to ask in the first place), doesn't mean the next examiner/regulator won't have a different opinion if they trace a covered transaction back to your institution.

I'll get down off my soap box now.

Periodic basis is an undefined term because it will mean different things to different banks. It is risk management. What are your locations, your volumes, etc.

And Anon's point is well taken. Early on when I had subsequent exams I knew what we did well in before. There were no reg changes and our products and procedures were the same. So we'll do well again, right? Trick question. Different examiners ask different questions, come to different conclusions and the bar gets raised in any event.

This is another of those requirements that you have to work backwards. OFAC doesn't waste time telling you how often to check the list. They simply tell you that if a person on the list has funds in your bank or tries to send funds through you bank, you have to block it and freeze it. The only way you will identify existing customers who appear on the list additions is to check the new lists against your entire customer base. This is risk-based and you take the risk of deciding how often to check names against the list.

I agree with everything stated and that is were the problem comes in relating to compliance, as there are degrees of compliance depending on the scenario so you end up thinking that everything needs to be done - at an unreasonably high cost, or you just do the minimum (I you see it) and examiners come around to set you straight.

It's a game, of sorts, but when you are naturally a person that is trying to achieve a "no exception" compliance environment - it makes you are little crazy!

Thanks for the post Andy.

Well, I'm setting up an annual review, based on a very low risk.