Since ChexSystems does not check the FBI Control list, I am wondering how everyone is handling New Accounts. Are you checking new customers to the Control List the next day?

Our data processing service provider (Metavante) offers a service that compares new customers to both the OFAC and Control Lists and gives us a daily report with possible matches. They will also run a full file comparison whenever we request it to show if any existing customers have been added to either list.

I think Most of the companies that offer OFAC solutions seem to be offering control list solutions as well.

My bank uses the WatchDog software and they offer the Control List check as well as the OFAC list check. The software can be loaded on a number of PC's such as the CSR's and wire transfer desks, loan underwriting, etc. and accounts can be checked when opened along with a periodic "scrub" of the entire customer database.

Karen Sue - Is there an the Internet address for the Watch Dog software?

It is www.attustech.com. We use it too, and like it.

Good to hear! We just bought it and are installing it today. I guess that means that the updates to the control list process works well?

Bear in mind that OFAC and Control List hits are to be handled differently. Procedures should be in place accordingly. And while I applaud the integration, is there an official position that the Control List is best reviewed regularly even though the instructions do not say that?

2. Is the search for names on the Control List a one-time search or an on-going search?

Banks are being asked to conduct a one-time search of the Control List pursuant to the guidelines in the Instructions to the Control List.

4. When a Supplement to the Control List is issued, does a bank have to re-search the original Control List again?

No. Banks need only conduct a one-time search for the names on the Supplement. Banks do not have to conduct another full search of the names on the Control List each time a Supplement is issued.

This is a confusing situation. Rhetorical questions. 1) While I believe that it is better to regularly review the List, it isn't required but is it desired by law enforcement since they say we "need only" check it once? 2) This is supposed to be a "need to know basis". Who incorporates it into the database, the bank or the vendor? 3) This is a somewhat confidential procedure, but we discuss it openly here, albeit without names, is this desired by law enforcement? 4) Why do they send us unencrypted files with confidential information?

We use the Jack Henry system which includes an OFAC module which checks accounts against the OFAC list. Are other banks using the JH system added the Control List names or how are you handling the Control List?

I asked about the control list confidentiality issue when I was negotiating the purchase of Watchdog. They were in contact with the FBI, and have agreed on procedures whereby both parties sign confidentiality agreements, and the bank actually provides the list to them (theoretically) before they put it into the database.

I haven't been through the process yet, but the premise sounds logical to me, and it did to my regulator.

Andy,

I have a call into Carol Mesheske at FDIC right now. I intend to ask her if we are required to check new customers to the list. I need to know because our auditing firm has stated that the FDIC compliance examiners expect us to do this. This came up during our recent Bank Secrecy Act audit. Hopefully, I will get a return call today. I'll share my findings.

Since we use ChexSystems for OFAC comparisons at new accounts, I am concerned. If we are required to compare new customers to the Control List, I need to devise procedures to make this happen. We have an Intranet and I suppose I could post it there, but I don't know if that is such a good idea considering this information is so CONFIDENTIAL.

As a side note, we use ITI and they will be offering an OFAC module soon. In a conference call last week, they told users that the FBI Control list is not incorporated into this module. They are unable to obtain a copy of the list from the regulatory agencies. In the Control List Q & A it says that we can provide the list to vendors, but I think we would have to make sure they kept it confidential. I'm not sure I would want that responsibility.

Lastly, it is my understanding that if the lists are combined into one, the user must be able to distinguish an OFAC hit from a Control List hit as the rules for handling each are different.

The Q&A specifically says it is meant to be a one-time search so I do not see the need to check all new accounts, daily. This would be far reaching as it would include your other services as well, not just loans and deposits.

The better question may be, do they mind ongoing search comparisons. My guess is no so long as they intend to advise us when names are removed.

Do you suppose that will change when 10-1-02 gets here and the new USA PATRIOT Act KYC (pardon me, EDD) rules go into effect? I believe that states that we must check all new account applications against any known government list.

Well here's the scoop. Carol Mesheske of FDIC told me this morning that we are NOT required to verify new customers to the Control List AT THIS TIME. If the proposal goes through that Louvera referred to, we will have to check the Control List as it will be considered a "government issued list."

Carol also said she will send a message to her regional office to make sure that examiners understand the current requirements.

Dolly - THANK YOU! I am looking at Audit procedures from our Internal Auditors that asks how we check the Control List for new customers. My first reaction was "Huh? The Control List is a one-time search for past transactions. It's NOT OFAC!"

My reasoning is the FBI is trying to re-construct the money trail for the terrorists they know or suspect were involved in the Sept. 11th attacks or other actions that were attempted or planned. While they may have a good idea of where these folks are now, they DON'T know where they've been.

OFAC is something else entirely, and yes, some poor guy with a name like Jose Ramirez popped up on the list. **sigh**

Diana--Our systems guy somehow runs the FBI list against our CIF files to identify possible matches. I think he uses the EXCEL list. If you need specific information, let me know and maybe I can hook you up with him. I am definitely not a systems expert.

I also asked the FDIC if after we had checked the control list and the supplements, we need to check the wires and new accounts done after the initial check is done? Their answer.....
___________________________________________________________
My understanding is that the FBI is interested in prior accounts and transactions involving the named individuals. That agency prepared the Control List and FAQ, and has asked indicated that it is interested in information going back, but not forward.
___________________________________________________________

So, we do not check against the Control list and supplements after the initial check.

We use ITI software and are outsourced through Fiserv. How can I share this control list with Fiserv without violating the confidentiality of the list as indicated by the agencies? I have had to complete a review manually.

Can someone assist me?

Thanks

Tina,

I wouldn't want to be the bank that shared the FBI Control list with a vendor - even if the agencies do say we can. How will you ensure that they keep it confidential?

I also agree with the other poster --- the FBI is mostly interested in PAST transactions.

Maybe I had an over zealous examiner, but he was adamant that we check CURRENT transactions, including outgoing/incoming wires against the Control List.

In hearing what the FDIC said, these guys took a different tract - just beware that there are examiners and regional individuals that believe that the Control List should be treated like the OFAC list.

I guess the thing to do is to ask that examiner WHERE is it stated we must check the Control List? What official regulation, or decree from the regulators, etc. states this? If you look at the instructions from the FBI for the Control List, it very clearly states you check PAST transactions.

Diana: I also use JH for OFAC. However, you do not need to use it for the control list, since the control list is a "one time" check only, as indicated in the other responses to this question. I've tried to use JH OFAC for listing SARs that the bank has filed, but I only find it more confusing when I receive the daily CF7590 report.

Heck, up until Congress passed the USA PATRIOT Act, there was no law and no regulation that required a check of OFAC lists, either. But regulators can and obviously have used their ability to create a safety and soundness issue to convince us all that OFAC lists are to be checked!

With the implementation of USA PATRIOT Act and its EDD (fka KYC) requirement for new accounts, regulators will now have the ability to back up their requirements with severe penalties.

Andy, can you please tell me where I can find the Q&A on the FBI Control List that you referred to in your post -Thanks

My list comes from the OCC and the Q&A is with the Control List. I get a Word and a PDF copy.

I would suggest requesting it from your regulator (in the event there are any differences) or contact me privately. I am hesitant to post the two page document here for bulk and confidentiality reasons.

Reviving an old thread (just 15 years )

I'm reviewing policies and procedures today and came across a section on the control list. Is this even something that's still in effect? I'll delete it if it's not but just want to be sure.