Hot topics from your recent BSA exams?

We have an upcoming FDIC BSA exam and I am wondering what the examiners are really focusing on at this point in time if you have had a semi-recent exam, specifically since Covid and PPP has occurred. I would appreciate any input or guidance.

We had an FDIC S&S (Dec 2020) and for BSA they did review our BSA AML OFAC Risk Assessments to see if PPP and COVID were included.

What, as an example, were they expecting to see included in the Risk Assessment?

Our FRB exam was in Oct 2020 and they did not ask about PPP and covid in the risk assessment.

We were not asked about PPP or COVID. They were very interested in our Risk Assessment process, who is responsible for RCSAs and the final product and how we use the results to tailor our program. Our model validation was reviewed heavily but the vendor we selected did a good job. We are FDIC regulated.

CDD and EDD or as the examiners are now calling it ADD.

Attention Deficit Disorder?

https://www.wusa9.com/article/life/.../65-ce24c9f5-43ba-4bd6-9191-04853364e8cd

I can hardly wait. Not.

Q4 FRB exam was fairly straightforward for us. Conducted completely remotely of course. Nothing COVID or PPP related although I had already put some vague commentary on it into our policy before they got here.

They went a bit more in-depth on employee training which I suspect was the result of an overzealous trainee. We use an online platform for annual training and the default number of allowed attempts was 10. It has been this way for years and has never been an issue but this time it led to further in-depth discussions with the training manager, review of the course content, etc. In the end I pulled a report showing that no one actually took 10 tries to pass and agreed to lower it to 5 attempts going forward based on their informal recommendation. I figured if that's how they wanted to spend their time then we must be doing ok overall.

They also brought up model validation for Verafin. We've been on the platform 1.5 years, they informally suggested we look at getting one in the next year.

That's about how I feel

Additional Due Diligence

I'm very interested to know what they were looking for in your risk assessment (or also policies and procedures) regarding PPP and Covid. The only thing I am coming up with is potentially adding due diligence steps to take to mitigate post-funding PPP risk.

We also had the FinCEN Advisory from April 2020 very early in the pandemic where financial institutions were instructed to notify FinCEN and their regulator if they were struggling to meet BSA reporting deadlines due to the pandemic.

If our internal controls had to be adjusted, if we had some late CTRs or SARs as a result of staffing issues with office closures, staff rotations and the like, then the examiners could be looking to the risk assessment to see if we identified risks that impacted our program as a result of COVID.

One of my clients just started their OCC exam and one of the first questions asked was, "Did you have to revise and procedures or processes as a result of COVID?"

We are an insignificant PPP, so it is not addressed in mine, but I did allude to COVID being the reasoning we saw certain trends shift in terms of transaction volumes, channel and product usage.

Model validation and CDD/EDD were the two biggest things. Training was also a hot topic. We're FDIC regulated as well.

For those that have had remote exams, how did they go? Did they do video calls and remote into your computer to share screens, etc?

No video call and no remote screen sharing. Pretty plain vanilla just had to provide some additional data that would have normally been reviewed when onsite.

I felt the remote exam was harder than in person. It could be just a bad year though.

Ditto. Lightest and shortest one I ever had. And only conference calls, no video or no screen sharing.

I will ditto that as well. I have a feeling when they come back this fall, it may be a little deeper than usual to make up.

Ours was tough as well. Multiple conference calls and remote sharing. We are FDIC regulated.