The Bank pulls a combined credit report on new loan customers from Kroll Factual Data (which includes info. from all three of the national credit reporting agencies). Within these credit reports is a section on OFAC Compliance, in which OFAC checks are ran as a part of the credit bureau report which usually states that the applicant name was searched and no matches were found on the OFAC SND list. The Bank generally considers this to be its OFAC check for new loan customers. We recently had an independent BSA audit and the auditor stated that we should contact the credit bureaus to determine how often they update their OFAC lists. Doesn't that seem to be going a little overboard? Has anyone else heard of this? We actually did try to contact at least one of the bureaus, and they basically laughed at us for asking.

Any thoughts on this?

Overboard and in the water.

We tried this once, but we found out that the source would not provide variations of the name. As an example, if John Smith were on the list, and we just put in Smith, it would tell us that there were no hits because John Smith was on the list, not Smith. We would have to enter John Smith to get the hit. We know from the 314(a) list that crooks love variations!

I would not use the term "overboard" and I would make the same type comment.

From the examination manual: "If a bank uses a third party, such as an agent or service provider, to perform OFAC checks on its behalf, as with any other responsibility performed by a third party, the bank is ultimately responsible for that third party’s compliance with the OFAC requirements.

As a result, banks should establish adequate controls and review procedures for such relationships."

I would be asking for the search criteria used by the credit bureau, the degree of confidence they apply to the searches, and even a copy of their SAS70 or other audit of the system by their outside auditor.

This is not an area that you can say "yeah - they do it for us" and think that is good enough.

Could you tell me where specifically this is located in the examination manual? Thanks.

Since he's supported his position with an excerpt from the examination procedures my agreement with rlcarey isn't really relevant, but I will offer it anyway.

I would add that it doesn't matter what assurances the vendor offers, you can readily test the currency of their lists by pulling recently added names and running them through your processes. You can test the sensitivity of their processes by slightly modifying the names. The more I think about it, a good vendor is going to set up a mechanism for you to do that and encourage you to use it.

Mr. Carey found his info on page 90 (document, not pdf.) As a pdf document, the examination procedures are searchable; whenever someone quotes them to you then you can search using a unique phrase and find it in seconds.

Quote:

---

you can readily test the currency of their lists by pulling recently added names and running them through your processes. You can test the sensitivity of their processes by slightly modifying the names. The more I think about it, a good vendor is going to set up a mechanism for you to do that and encourage you to use it.

---

Normally I would agree with you Ken, but since this is a credit bureau, that type of testing might be a little more difficult then using this type of testing on a system that only does the OFAC screening.

You're obviously right, but that really "good" vendor I mentioned would facilitate the testing by setting up some pseudo entries for that purpose.