I want to make a general comment, don't read too much into CIP and lets not make CIP any more difficult than it is. I assure you my policy won't be perfect on day one. But the examiner's are not going to play gatcha either. Remember Privacy. We all got through that, and with some regulatory assistance in some cases.

I believe reasonable efforts will be greeted with reasonable reviews. So don't ignore it by any means and do pay attention to detail. While it isn't easy, it isn't impossible either since absolute perfection isn't a requirement.

I believe it would be easy to write 100% compliant procedures, but they also have to be workable. That is what makes them difficult. So do the best you can and be prepared to tweak. Lets take a deep breath now....

My sentiments, exactly! And yet this interesting quote from Michael A. Dawson, Deputy Assistant Secretary, Critical Infrastructure Protection and Compliance Policy, Department of the Treasury, made two days ago at a speech in Washington, DC, "The joint 326 rule is, I am told, one of the largest, most complicated joint rulemakings that our experts can remember." Go figure.

I had to use your advice on Jim the other day when he was overanalyzing and I said, " Come on...it doesn't have to be perfect!" Coming from me that was quite a revelation!

Opinions are my own and not those of my employer.

Me, overanalyzing?

So, just curious Andy. Are there any circumstances in your bank where you will require the use of one of the outside vendors that provide the comprehensive verification process compared to a multitude of databases? I'm not referring to ChexSystems or credit bureau reports. We will continue to use those non-documentary sources anyway. We have been seriously considering an outside source for indirect, no face to face contact. Higher degree of risk. What are you thinking?

We are considering it, but need to be sure the risk is cost-justified. But I do not believe I will recommend some of the d-bases out there that checks every known d-base to exist. Too much information. I don't want to spend $100M+ annually. This is a new rule, in a way. Perhaps we'll say a more formalized rule for what we have been doing to one extent or another already. The world didn't change since CIP was released and neither have my markets. We'll be cautious, more detailed and we will employ some basic verifications not used in the past, but I didn't need to know who was on some obscure list 6 months ago, why now.

I agree, Andy. I have sat through presentations by some of the most well known vendors and heard them make totally untrue statements that lead me to believe they stopped listening a while ago....some are still talking about the need to check 326 lists (and this was last week!) I corrected them on that one. They are complicating things to make sales in some cases and using scare tactics. We don't need to go overboard.

Andy you are sooo right! I came to realize just a few days ago that I had to look at this whole thing from a different angle. I was just overthinking the whole process. After going to bed every night irritable and getting up each morning even worse for days on end, I came to the realization that I had to get a handle on this before it did me in! (not to mention the people around me) I will send a simple and general policy to the Board. Procedures will NOT be taken to the Board...per the CEOs request. I will do a little "tweeking" of the procedures and we will give the whole thing a try. Problems will be resolved as we go and procedures will be adjusted. That's why it is absolutely stupid to take procedures to the Board. Now, will the regulators like it.....probably not but they don't like anything these days anyway now do they?

Also, while I am on my soapbox....sorry everyone......I expect this CIP thing to have about as little effect on terrorists as Privacy had on telemarketers. Agree?

BankerMama, I absolutely agree. I have said on several occasions that this regulation is fatally flawed. I think it's the equivalent of the busy work you used to get in the first grade. The problem is, it's resulting in a waste of compliance resources throughout the banking industry. With that said, we still have to comply, and I think Andy's comments are timely and right on point (as usual).

Just to add a few more thoughts...

As with any new regulation, there is no 'industry standard' or 'best practice' to go by. Down the road, there will be, and much of what we do now to tame CIP will contribute to the benchmark. It's important that we not hang ourselves with our own rope.

Start with the idea that you already had a CIP. Write it down. Compare it to the requirements of the regulation. Tweak or adjust as necessary. Put the end result before the board for its approval. Keep the important stuff.

This is a marvelous forum for getting input on the obscure questions, but those questions involve 1-5% of the total compliance effort. Keep your eye on the prize.

Thanks very much Andy. Appreciate your comments as I prepare to put pen to paper to draft our CIP.

You guys have made my day. As a compliance professional it is so good to hear someone say, "hey, you're right". And maybe this will make someone else's day a little easier too with those expeditious tips from Ken.

It is soooo great that we can all help each other get the real perspective on these issues! Thanks, Andy and all you other "gurus".

If you break this whole CIP thing down to what it's actually supposed to be doing, most of us will find that we're already doing more than what's required, anyway.

There may be minor things like recording a description of the driver's licenses and posting a notice in the lobby, but, hey, don't we try to "form a reasonable belief" that we know who our customers are, already?

We're all already doing the main stuff -- it's just the little details that have to be tightened up to "do CIP".

Oh yeah, then there's the whole "writing it down" part - but that's easy. Just copy the Reg and where it says "the bank must", change it to "the bank will". Fill in some details about what types of documents you'll accept, what non-doc procedures you'll use, and you're done. It's not tough once you get going.

DON'T PANIC!

Andy, normally I would tend to agree as you are the voice of reason. But we thought we took all reasonable steps to cover Privacy--board approvals, timely notifications, legal counsel consultation--but we still got stuck with some derogatory examination comments that required additional outlay of resources to fix Privacy. I think they will be equally if not more strict on CIP which is part of the reason myself and our CIP guru are beating are heads against the wall because we can't seem to get any cooperation from our lenders. Oh well, sorry for the rant but it is cloudy and rainy here today..have a greatr weekend all and GO ERNIE ELS at SANDWICH.

Good Job Andy - you echoed the words of Daniel Stipano, Deputy Cheif Counsel at the OCC who spoke at the DC compliance conference. He told the attendees we were reading too much into section 326. I know that is not a license to slack-off on CIP but he wanted people to relax and be practical and remember that "one size does not fit all." Our programs should be tailored to our business, customer base and varying risk levels.

Andy-and all of the others that reponded- thanks. As a compliance professional and a 9/11 survivor in NYC (I worked in the WTC complex for Am Ex) I have a slightly different take on all this.

That day has put everything in a different light for me. I can't control what the regulators dictate, so I will do the best that I can. I will no longer loose sleep over work because life is too short (beleive me I know - I saw too many peoples lives being snuffed out). If the regulators don't like what I did or am doing I will change it. But under no circumstance will I let drive me crazy like it used too.

As compliance professionals we all have to sit back and realize there is more to life than compliance or work. I am not saying that we should not do our best at our jobs (where we receive very little reward other than self-satisfaction - even though everyone else thinks that we are a hindrance to business)but we should enjoy what life has to offer and put compliance in the proper perspective.

Just a word of advise to all of you out there (and you know who you are) that take work a little bit to seriously

Quote:

---

some are still talking about the need to check 326 lists (and this was last week!)

---

kaybee: I don't know exactly what was being said, but the list checking requirement is still in the regulation. The preamble to the regulation says that financial institutions "will receive notification by way of separate guidance regarding the lists that must be consulted for purposes of this provision". So it's not wrong to talk about a list checking requirement in general, as long as they aren't saying that the list or lists have been defined yet.

Earlier I heard of vendors grouping d-base searches in with 326 like they were all a part of the same requirement, SSAN listing, telephone directory, wanted lists, etc.

It reminded me of when we had changes in the flood rules and there was a misconception that everyone had to obtain life of loan and review their existing portfolios.

The vendor I was meeting with was speaking of the difficulty of knowing you are checking the correct lists to comply with 326, bringing OFAC, Dept of Commerce list, State Dept., etc into the conversation. They obviously were not quite up to date on what the regulators have now said....you must check the 326 list(s) and when we have one we will let you know that this is a 326 list.

I agree Andy. After all, this isn't the kickoff of Reg. Z (not that I was around then.)