Static Page - AML/BSA Monetary Penalties List

On June 28, 2013, the Office of the Comptroller of the Currency issued a Consent Cease and Desist Order to TIAA-CREF Trust Company, FSB, St. Louis, Missouri (Bank).

The Bank is a federally chartered savings bank with its only office located in St. Louis, Missouri. Its FDIC-reported financials for March 31, 2013, show a 236% growth in total assets over March 31, 2012 ($681 million to $2287 million), and a growth in staffing from 74 to 105 FTEs. The company was established in 1998.

The C&D Order has several articles requiring the bank's board to ensure it has competent management, a viable strategic plan, a capital plan, and improved management of its liquidity, funding concentration, interest rate risk and information security. Several articles, however, focus on BSA/AML concerns, requiring the bank to develop of put into place—

1. a comprehensive BSA action plan
2. a BSA risk assessment
3. BSA independent testing
4. BSA internal controls and high risk identification
5. CDD and EDD information gathering
6. a written program to ensure compliance with SAR filing requirements
7. BSA training
8. appropriate BSA compliance department staffing

On June 17, 2013, the Federal Reserve Board released a Written Agreement with M&T Bank Corporation (M&T) and one of its subsidiaries, Manufaturers & Traders Trust Company (Bank), both of Buffalo, New York.

M&T is a bank holding company that also owns and controls various non-bank subsidiaries, including Wilmington Trust Company, Wilmington, Delaware (WTC). WTC voluntarily surrendered its FDIC insurance and became a non-bank in 2011. WTC provides a variety of products and services to private and institutional customers, including wealth advisory and foreign correspondent account services.

M&T had adopted a firm-wide compliance risk management program for its subsidiaries, including the Bank, designed to identify and manage compliance risks related to BSA and AML requirements. M&T also undertakes to conduct customer due diligence and transaction monitoring on behalf of its subsidiaries. The FRB of New York identified, in its most recent inspection of M&T, deficiencies in M&T's firm-wide compliance risk management program with respect to compliance with BSA/AML Requirements; the Bank's internal controls, customer due diligence procedures, and transaction monitoring processes with respect to compliance with BSA/AML Requirements; and WTC's due diligence practices for foreign correspondent accounts.

The Written Agreement requires that M&T adopt, submit and adhere to an acceptable revised written firm-wide BSA/AML compliance program that describes the specific actions that will be taken, including timelines for completion, to ensure compliance with applicable BSA/AML Requirements. Required elements of that program are spelled out, including the findings and recommendations of a consultant "recently engaged by M&T to assist in matters related to compliance with the BSA/AML Requirements."

The Bank agreed to engage an independent consultant to conduct a review of account and transaction activity associated with high--risk customer accounts from 7/1/12 to 12/31/12, to determine whether suspicious activity was appropriately reported. The Reserve Bank may order similar reviews for other time periods

On January 25, 2013, the OCC announced that it had issued a consent order for the assessment of a $10 million civil money penalty against TCF National Bank, with a home office in Sioux Falls, SD, and 436 total offices in Arizona, Colorado, Illinois, Indiana, Michigan, South Dakota, and Wisconsin.

The OCC had in July 2010 issued a consent C&D order (see below) for failure to establish and maintain an adequate BSA/AML program, citing SAR violations, and program violations.

Under the earlier Order, the bank had a consultant conduct a look-back to review activity specified in the Order from November 2008 through July 2010, which resulted in the bank's late-filing of 2,357 SARs covering transactions of about $70 million, involving structuring and other extraordinary customer transactions. In a November 2011 exam, the OCC identified 13 failures to properly file SARs on transactions possibly related to terrorist financing (the SARs had been filed, but were determined to be inadequate and "of poor quality." For example, the "terrorist financing" box on the SARs had not been checked (although the narrative made reference to possible terrorist financing), and in some cases, the narrative section was considered inadequate.

On 11/16/2012, the FDIC and FinCEN announced the assessment of concurrent CMPs of $15 million against the bank, for violations of the BSA and AML laws and regulations. The bank also settled civil charges on related activities brought by the Justice Department. All penalties will be satisfied by a single $15 million payment to Treasury.

The FDIC and FinCEN determined that the bank failed to implement an effective BSA/AML Compliance Program with internal controls reasonably designed to detect and report evidence of money laundering and other suspicious activity. Specifically, the bank failed to adequately oversee third-party payment processor relationships and related products and services in a manner commensurate with associated risks. The civil money penalty is the result of the bank's history of noncompliance with laws and regulations and its numerous violations of the BSA.

To make money, First Bank of Delaware entered into risky lines of business and chose to disregard its Bank Secrecy Act responsibilities,” said FinCEN Director Jennifer Shasky Calvery. “As a result of its failure to implement systems and controls to identify and report suspicious activities, as required by the BSA, financial predators were able to victimize consumers.”

One of the bank's services cited in the FinCEN CMP Order was a Remotely Created Check (RCC) service operated by five third party payment processors. The bank failed to adequately monitor and control excessive unauthorized returns of RCCs deposited through the service. The bank also had major ACH merchant clients, one of which ran almost $22 million in ACH transactions for a foreign-based MSB in the business of "facilitating banking transactions."

On November 16, 2012, Bryn Mawr Trust Company, Bryn Mawr, Pennsylvania, purchased certain assets and assumed deposit liabilities from the First Bank of Delaware. The Delaware Office of State Bank Commissioner terminated First Bank of Delaware's charter and the FDIC terminated its deposit insurance.

On 11/9/2012, the Department of Justice announced that Moneygram International, Inc., agreed to forfeit $100 million and enter into a five-year deferred prosecution agreement in which it admits to criminally aiding and abetting wire fraud and failing to maintain an effective anti-money laundering program. According to court documents, MoneyGram was involved in mass marketing and consumer fraud phishing schemes, perpetrated by corrupt MoneyGram agents and others, that defrauded tens of thousands of victims in the United States. MoneyGram also failed to maintain an effective anti-money laundering program in violation of the Bank Secrecy Act. The Justice Department will return the forfeited funds to the victims of the fraud scheme through its Victim Asset Recovery Program.

On 4/5/2012, the OCC issued a press release announcing that it issued on 4/4/12 a cease and desist order against Citibank, N.A. for violations of the Bank Secrecy Act and underlying regulations. According to the OCC, the order requires the bank to take comprehensive corrective actions to improve its BSA compliance program.

The compliance program alledgedly had deficiencies with respect to internal controls, customer due diligence, the independent BSA and anti-money laundering audit function, monitoring of its remote deposit capture and international cash letter instrument processing in connection with foreign correspondent banking, and suspicious activity reporting related to that monitoring. These findings resulted in violations by the bank of statutory and regulatory requirements to maintain an adequate BSA compliance program, file suspicious activity reports, and conduct appropriate due diligence on foreign correspondent accounts.

As part of the Order, the bank is required to arrange for an independent look-back for suspicious activity covering areas (and presumably time-frames) to be designated by the bank's Examiner-in-Charge.

On 8/22/11, FinCEN, the FDIC and the FL Office of Financial Regulation (OFR) issued a joint press release announcing Orders [FinCEN; FDIC] for the assessment of concurrent civil money penalties of $10.9 million against Ocean Bank, Miami, Florida, for violations of federal and state Bank Secrecy Act (BSA) and anti-money (AML) laundering laws and regulations. Ocean Bank, without admitting or denying the allegations, consented to payment of the civil money penalties, which was satisfied by a single payment to the U.S. Government. [In March 2007, the FDIC issued Ocean Bank a C&D relating to the alleged violations. See below.

The CMP Order alleges violations of the BSA and implementing regulations (31 CFR Chapter X, 12 CFR § 326.8 and 12 CFR Part 353), violations of the 2007 C&D and violations of applicable Florida statutes and regulations. The Orders cite the filing of a criminal Information and a Deferred Prosecution Agreement by the U.S. Attorney's Office, Southern District of Florida.

FinCEN announced that is issued an Order for Assessment of Civil Money Penalty (CMP) for $250,000 against the Lower Sioux Indian Community d/b/a Jackpot Junction Casino Hotel, Morton, MN, on April 20, 2011. The Jackpot Casino, with annual gaming revenues exceeding $1 million, is subject to the Bank Secrecy Act and implementing regulations. It is examined for compliance by the IRS. FinCEN found that the Casino, during the period from 4/1/2006 through 5/28/2009, œcommitted extensive violations of the anti-money laundering program and reporting requirements of the Bank Secrecy Act and its implementing regulations, and œsuffered from material deficiencies in multiple core elements of its anti-money laundering program, which also resulted in violations of the currency transaction reporting and suspicious activity reporting requirements of the Bank Secrecy Act. 

The OCC issued a press release on 3/24/11, announcing that it had issued a Consent Order for a $7 million Civil Money Penalty against Pacific National Bank, Miami, FL. The release also reported that FinCEN had ordered a concurrent $7 million penalty (a single $7 million payment will satisfy both penalty orders).

The OCC had issued an earlier Consent Order against the bank in 2005, directing that the bank findings that it had failed to establish and maintain procedures reasonably designed to assure and monitor [its] compliance with the Bank Secrecy Act and that the bank had violated the OCC's SAR requirements and BSA compliance program regulations. In an exam starting on March 25, 2009, the OCC determined that the bank continued to be in violation of the BSA and Treasury and OCC regulations. Similar violations were identified in a March 23, 2010 exam. In the exams, the OCC found that the bank failed to

• develop and implement an effective risk assessment program;
• ensure that sufficient and qualified Bank resources were available to effectively manage the BSA/anti-money laundering risk, comply with applicable laws and regulations, correct violations, and remediate other deficiencies addressed in the 2005 BSA Order in a timely manner;
• implement adequate policies, practices, procedures and internal controls for conducting customer due diligence and enhanced due diligence;
• implement effective policies, procedures, and internal controls to ensure effective monitoring, customer due diligence, and enhanced due diligence pertaining to the Bank's foreign correspondent bank accounts;
• implement appropriate procedures for identifying, monitoring and reporting suspicious activity;
• identify and report suspicious activity involving foreign correspondent bank accounts;
• file suspicious activity reports and report ongoing suspicious activity in a timely manner;
• ensure that adequate and timely independent audits were conducted and that full audit reports issued; and
• identify and monitor suspicious activity in the bank's bill payment systems.

Among the factors cited as causing the bank's failure to comply are (i) failure to recognize the risk inherent in foreign correspondent bank accounts and to adequately monitor transactions in light of that risk; (ii) inadequate staffing of the BSA department; (iii) failure to have adequate policies and procedures governing the foreign correspondent bank accounts; and (iv) inadequate collection and analysis of customer due diligence and enhanced due diligence information.

FinCEN issued a press release on 3/8/11, announcing that it had assessed a $25,000 CMP against Victor Kaganov of Tigard, OR, for œviolating Bank Secrecy Act (BSA) requirements for money transmitters. FinCEN determined that Kaganov violated BSA registration, anti-money laundering program, and suspicious activity reporting requirements while conducting an independent money transmitter business from his residence. Kaganov is alleged to have œconducted more than 4,200 funds transfers in the United States, involving total dollars amounting to more than $172 million, to and from a number of locations in Europe and Asia from 2002 through 2009. In a typical transaction, funds were wired into a U.S. bank account controlled by Kaganov, and from there Kaganov instructed his bank to transmit the funds to a third party beneficiary. Kaganov repeatedly conducted business in violation of the BSA and outside the regulatory framework for money transmitters.

Kaganov also pled guilty on March 1 to a single count of operating an inlicensed money transmitting business, for which he was charged in federal court on March 3, 2010 (see DOJ Release). He is scheduled for sentencing on April 19, 2011.

Omar Abukar Sufi and his brother, Mohamed Abukar Sufi, operated Halal Depot of Wyoming, Michigan, a money transmission business, as part of their grocery store operation. The Sufi brothers sent funds on behalf of their customers to persons in Yemen, Somalia, Sudan, Kenya, Saudi Arabia, Uganda, Ethiopia, Qatar, Europe and the United Arab Emirates. At no time did the Sufi brothers register with FinCEN as a money services business (MSB) as required by the BSA. According to the FinCEN press release, the money transmission business œfacilitated the transfer of tens of thousands of dollars over the course of multiple years. The [Sufi] brothers accepted cash and other instruments, such as food stamp proceeds, and charged fees of 6-7 percent per transaction to facilitate these transfers. They recently pled guilty in United States District Court for the Western District of Michigan to federal criminal charges of food stamp fraud and operating an unlicensed money transmitting business, among other charges. The brothers were sentenced to five years in prison and required to pay restitution to the U.S. Department of Agriculture which funds the food stamp program.

Mizrahi Tefahot Bank, Ltd. is chartered as a U.S. branch of a foreign institution. It has one office, in Los Angeles, CA. On 1/31/11, the FDIC and the California Department of Financial Institutions (DFI) issued the bank a $350,000 CMP Order, half to be paid to the U.S. Treasury and half to the DFI.

The Order states that the agencies believe that from at least 200 through 2009, the bank lacked an adequate program to monitor, analyze, and report suspicious activity. In addition, the FDIC and the DFI have determined that the Bank had failed to comply with an August 27, 2008 Consent Order issued by the FDIC and the DFI.

1. failed to adequately monitor over $5.4 billion of activity in 2006 and 2007 for a new product initiative, specifically remote deposit capture (œRDC), offered to former foreign correspondent customers, including casas de cambio (CDCs)
2. failed to adequately monitor wire activity of its former foreign correspondent customers, including $7.9 billion of wire activity with CDC customers in 2006 and 2007, before the Bank exited the line of business in early 2008
3. had inadequate SAR processes for its former CDC and foreign correspondent customers and failed to file Suspicious Activity Reports (SARs) on a timely basis with respect to those customers
4. failed to comply with the business' policies and statutory requirements regarding customer due diligence (CDD) and enhanced due diligence (EDD) for its former foreign correspondent customers for a period of two years, from 2006 to early 2008
5. therefore was in violation of 31 U.S.C. § 5318(g) and 12 C.F.R. §21.11, and of 31 U.S.C. § 5318(i) and 31 C.F.R. §103.176.

The following is excerpted from the FinCEN Order:

Zions utilized RDC to process certain deposit items from its non-United States correspondent accounts. RDC, a deposit-transaction delivery system, allows a financial institution to receive digital information from deposit documents captured at remote locations such as financial institution branches, ATMs, domestic and foreign correspondents, or locations owned or controlled by commercial or retail customers of the financial institution. In substance, RDC is similar to traditional deposit-delivery systems at financial institutions. However, RDC enables customers of financial institutions to deposit items electronically from locations globally.

œRDC introduces additional risks beyond traditional deposit-delivery systems because it enables a bank's customers to scan a check or monetary instrument and then send the scanned or digitalized image to the financial institution without the need for face-to-face transactions. This change in the interaction process for executing such transactions raises several challenges, including but not limited to: (i) the difficulty of determining in what jurisdiction the equipment is being used and by whom; (ii) development of internal controls to ensure transaction data and check images are not altered; and (iii) implementation of monitoring by qualified personnel for potentially fraudulent, sequentially numbered or altered money orders or traveler's checks.

• To "develop, implement, and thereafter ensure Bank adherence to a written program of policies and procedures to provide for compliance with the Bank Secrecy Act (œBSA), as amended (31 U.S.C. § 5311 et seq.), the regulations promulgated thereunder at 31 C.F.R. Part 103, as amended, and 12 C.F.R. Part 21, Subparts B and C, and the rules and regulations of the Office of Foreign Assets Control (œOFAC) (collectively referred to as the œBank Secrecy Act or œBSA) and for the appropriate identification and monitoring of transactions that pose greater than normal risk for compliance with the BSA.
• To "develop, implement, and thereafter ensure Bank adherence to account-opening procedures for all accounts by requiring:
• identification of all account owners and beneficial owners in compliance with 31 C.F.R. § 103.121 and the Interagency Statement on Beneficial Ownership Information (OCC 2010-11);
• identification of the officers, directors, major shareholders or partners, as applicable, of business accounts;
• documentation of the following information for all deposit account customers:
  • any relevant financial information concerning the customer;
  • the type of business conducted by the customer;
  • the customer's source of income or wealth; and
  • any other due diligence required by this Order, the BSA Officer or the Bank.
• To "develop, implement, and thereafter ensure Bank maintenance of an integrated, accurate system for all Bank areas to produce periodic reports designed to identify unusual or suspicious activity, including patterns of activity, to monitor and evaluate unusual or suspicious activity, and to maintain accurate information needed to produce these reports."
• To "develop, implement, and thereafter ensure Bank adherence to a written program of policies and procedures to provide for the Bank's monitoring of suspicious cash, monetary instruments, wire transfers, and other activities for all types of transactions, accounts, customers, products, and services."
• To "develop, implement, and thereafter ensure Bank adherence to comprehensive procedures to identify and report to appropriate management personnel:
• frequent or large volume cash deposits or wire transfers or book entry transfers to or from offshore or domestic entities or individuals;
• wire transfers or book entry transfers that are deposited into several accounts;
• receipt and disbursement of wire transfers or book entry transfers without an apparent bona fide business reason;
• receipt and disbursement of wire transfers or book entry transfers that are suspicious or when they are inconsistent with the customer due diligence information and the customer's business; and
• receipt and disbursement of currency or monetary instruments when they are inconsistent with the customer due diligence information and the customer's business."
• To "ensure that the BSA audit function is supported by an adequately staffed department or outside firm, with respect to expertise, experience and number of the individuals employed."

• 31 U.S.C. § 5318 (h), 31 C.F.R. § 103.120(b), and 12 C.F.R. § 563.177 (requiring an effective AML program);
• 12 C.F.R. § 563.180(d) and 31 C.F.R. § 103.18 (requiring the timely filing of accurate Suspicious Activity Reports (SARs)); and
• 31 C.F.R. § 103.22 (requiring the filing of Currency Transaction Reports.

1. failed to implement adequate policies, procedures, or monitoring controls governing the repatriaation of nearly $14 billion of USD bulk cash for high risk casa de cambrio ("CDC") and other foreign correspondent customers (over $10 billion coming from Mexico into the U.S.);
2. failed to conduct monitoring of high volumes of monetary instruments flowing through the CDCs and other foreign correspondent accounts in the form of Remote Deposit Capture ("RDC") products, consisting of nearly six million checks worth approximately $41 billion;
3. failed to appropriately monitor traveler's checks in a manner that was consistent with the Bank's policy limits over sequentially number traveler's checks for high risk CDC customers;
4. failed to appropriately institute risk-based monitoring of the Bank's foreign correspondent customers, primarily as a result oif placing too much emphasis on staffing considerations when setting alert parameters;
5. failed to file timely SARs involving suspicious transactions conducted through certain foreign correspondent accounts at the Bank;
6. after conducting a voluntary lookback, the Bank filed over 4,300 SARs involving suspicious transactions conducted through the Bank by CDCs and high risk foreign correspondent customers. A significant number of these SARs were not timely filed; and
7. failed to adequately report cash structuring activity from review of alerts generated in the Bank's Financial Intelligence Unit.

• operating in violation of section 326.8 of the FDIC Rules and Regulations, 12 C.F.R. § 326.8, regarding a satisfactory Bank Secrecy Act (œBSA) and Anti-Money Laundering (œAML) compliance program;
• operating in violation of section 353.3 of the FDIC Rules and Regulations, 12 C.F.R. § 353.3, regarding Suspicious Activity Report (œSAR) procedures to identify, monitor, and report suspicious activities;
• operating in violation of section 103.100(b)(2)(i) of the Rules and Regulations of the Department of the Treasury, 31 C.F.R. § 103.100(b)(2)(i), regarding the failure to conduct section 314(a) information sharing and search requests within the prescribed time frames;
• operating in violation of section 103.21 of the Rules and Regulations of the Department of the Treasury, 31 C.F.R. § 103.21, regarding procedures to establish minimum identification verification requirements;
• operating in violation of section 103.22 of the Rules and Regulations of the Department of the Treasury, 31 C.F.R. § 103.22, regarding Currency Transaction Report (œCTR) procedures to report large dollar currency transactions;
• operating in violation of section 103.27 of the Rules and Regulations of the Department of the Treasury, 31 C.F.R. § 103.27, regarding the failure to file Currency Transaction Reports (œCTRs) in a timely fashion;
• operating in violation of section 103.29 of the Rules and Regulations of the Department of the Treasury, 31 C.F.R. § 103.29, regarding the financial recordkeeping requirements; and
• operating in violation of section 103.63 of the Rules and Regulations of the Department of the Treasury, 31 C.F.R. § 103.63, regarding inadequate procedures to accurately detect structured transactions.

• "processing ACH transactions for merchants" and
• "processing Remote Deposit Capture (RDC) transactions for money service businesses"

1. an assessment of the risks and benefits of the product or service to the Bank;
2. an explanation of how the product or service is consistent with the Bank's strategic plan;
3. an evaluation of the adequacy of the Bank's organizational structure, staffing, MIS, internal controls and written policies and procedures to identify, measure, monitor, and control the risks associated with the product or service; and
4. a profitability analysis, including growth projections and interest rate risk."

• Develop, adopt and implement a written plan for continued administration of a program reasonably designed to ensure and maintain compliance with the BSA Rules.
• Review, enhance and implement a written customer CIP appropriete for the bank's size and type of business, addressing criticisms in its most recent report of examination.
• Update the bank's overall risk assessment of its compliance with the BSA risks.
• Establish and implement monitoring and reporting procedures for SARs and CTRs.
• Contract with an independent auditor to conduct a forensic review of all high-risk accounts and transactions since 1/1/2008 to determine whether any CTRs or SARs need to be filed.
• Revise its BSA, AML and OFAC policies, procedures and practices to provide for risk ratings of customers, monitoring of high-risk accounts (using software), and systems for account aggregation for the purposes of determineing when CTRs or SARs need to be filed, documentation standards for new accounts, and methods for enforcing those policies, procedures and practices (with consequences specified for noncompliance).
• Set up a written CDD program, to include EDD for high risk customers.
• Establish written standards for independent testing of BSA, AML and OFAC compliance.
• Adopt and implement a comprehensive written audit program that includes periodic and thorough reviews of compliance with BSA rules.
• Provide for BSA, AML and OFAC training of personnel commensure with their duties, assignments and responsibilities. Specifically listed in the order are directors, executive officers, department heads, supervisors, loan officers, loan operations staff, tellers, bookkeepers, couriers, proof operators, IT staff and write-transfer staff.
• Analyze staffing needs for BSA Department.
• Designate a qualified BSA officer with appropriate responsibility and authority.

1. Operating the Bank with a Bank board of directors (Board) which has failed to provide adequate supervision over and direction to the executive management of the Bank to prevent unsafe or unsound banking practices and violations of law, rule and regulations.
2. Operating the Bank with an ineffective system of internal controls, including ensuring ongoing compliance with the BSA and information technology (IT) requirements.
3. Operating the Bank without an effective BSA/anti-money laundering program.
4. Operating in violation of section 326.8, of the FDIC's Rules and Regulations, 12. C.F.R. § 326.8, and the Treasury Department's Financial Recordkeeping Regulations, 31 C.F.R Part 103.
5. Operating the Bank with management whose practices have resulted in numerous violations of laws and regulations and contraventions of policy.
6. Directly conducting any and all types of activities associated with or in any way using the Society for Worldwide Interbank Financial Telecommunication (œSWIFT) messaging system, or any other similar system used to facilitate international trade.
<
7. Conducting any and all types of activities associated with shell banking organizations.

• Develop, adopt and implement a written compliance program designed to ensure and maintain compliance by the Bank with the BSA and related rules and regulations (a detailed list of expectations for the program are included in the Order).
• Develop, adopt and implement a written customer due diligence program (with a detailed list of features in the Order).
• Revise, adopt and implement its BSA policy to include the requirements of the Order.
  
  

1. Operating in violation of the Currency and Foreign Transactions Reporting Act (31 U.S.C. § 5311 et seq.) (Bank Secrecy Act) (BSA), the rules and regulations implementing the BSA issued by the U.S. Department of the Treasury (31 C.F.R. Part 103) (Financial Recordkeeping), the FDIC's BSA Programs and Procedures Regulations, 12 C.F.R. Part 326 (BSA Programs and Procedures), and the FDIC's Suspicious Activity Reports (œSARs) regulations, 12 C.F.R. Part 353; and
2. Operating with a board of directors that has failed to provide adequate supervision over and direction to the management of the Bank to prevent unsafe or unsound banking practices and violations of laws or regulations.
3. Operating the Bank with an ineffective BSA/Anti-Money Laundering (AML) Compliance Program;
4. Operating the Bank with an ineffective system of internal controls to ensure compliance with the BSA Rules;
5. Operating the Bank with an ineffective BSA/AML training program to ensure compliance with the BSA Rules;
6. Operating the Bank with an ineffective BSA officer to properly direct, administer, and oversee the BSA program; and
7. Operating the Bank with an ineffective Customer Due Diligence Program (CDD) to ensure compliance with the BSA Rules.

1. Operating without effective Board oversight and executive management supervision to prevent unsafe or unsound banking practices and violations of laws and/or regulations related to the Bank Secrecy Act (œBSA), subchapter II of Chapter 53 of Title 31 of the United States Code, and its implementing rules issued by the U.S. Department of Treasury, 31 C.F.R. Part 103; the regulations of the Office of Foreign Asset Control (œOFAC); the FDIC's BSA compliance regulations, 12 C.F.R. § 326.8, and the FDIC's suspicious activity report regulations, 12 C.F.R. Part 353 (œPart 353) (collectively, œBSA Rules);
2. Operating with an ineffective system of internal controls to ensure ongoing compliance with the BSA Rules;
3. Operating without effective coordinating and monitoring procedures by a designated individual responsible for ensuring day-to-day compliance with the BSA Rules; and
4. Operating with an ineffective customer identification program (œCIP). CIP is the collective reference to section 103.121 of the Rules and Regulations of the Department of Treasury, 31 C.F.R. § 103.121.

1. Operating the Bank in violation of the Currency and Foreign Transactions Reporting Act (31 U.S.C. § 5311 et seq.) (the Bank Secrecy Act) (œBSA), the rules and regulations implementing the BSA issued by the U. S. Department of the Treasury (31 C.F.R. Part 103) (œFinancial Recordkeeping), and the FDIC's BSA Rules and Procedures Regulations, 12 C.F.R. Part 326; and the FDIC's Suspicious Activity Reports (œSARs) regulations, 12 C.F.R. Part 353 (all the rules referred to in this paragraph are referred to hereinafter, collectively, as œBSA Rules);
2. Operating the Bank without adequate supervision and direction by the Bank's Board of Directors and senior management of the Bank to prevent unsafe and unsound banking practices and violations of Federal and State laws or regulations and to ensure compliance with the BSA Rules;
3. Operating the Bank with an ineffective BSA/Anti-Money Laundering (œAML) Compliance Policy;
4. Operating the Bank with an ineffective system of internal controls to ensure compliance with the BSA Rules;
5. Operating the Bank with an ineffective BSA/AML training program to ensure compliance with the BSA Rules;
6. Operating the Bank with an ineffective Customer Due Diligence Program (œCDD) to ensure compliance with the BSA Rules;
7. Operating the Bank without an effective system of independent testing to ensure compliance with the BSA Rules;
8. Operating the Bank without effective Office of Foreign Asset Control (œOFAC) policies and procedures;
9. Operating the Bank without a qualified individual responsible for BSA compliance;
10. Failing to file a SAR on transactions designed to evade BSA regulations:
11. Failing to maintain a due diligence program for correspondent accounts at foreign financial institutions;
12. Failing to take reasonable steps to prohibit banking services to foreign shell banks;
13. Failing to maintain records of persons willing to accept service of process for foreign financial institutions; and
14. Failing to furnish required information on Currency Transaction Reports (œCTR).

1. Operating the Bank in violation of the Currency and Foreign Transactions Reporting Act (31 U.S.C. § 5311 et seq.) (the Bank Secrecy Act) (œBSA), the rules and regulations implementing the BSA issued by the U. S. Department of the Treasury (31 C.F.R. Part 103) (œFinancial Recordkeeping), the FDIC's BSA Rules and Procedures Regulations, 12 C.F.R. Part 326, and the FDIC's Suspicious Activity Reports (œSARs) regulations, 12 C.F.R. Part 353 (all the rules referred to in this paragraph are referred to hereinafter, collectively, as œBSA Rules);
2. Operating the Bank without adequate supervision and direction by the Bank's board of directors and senior management of the Bank to prevent unsafe and unsound banking practices and violations of Federal and State laws or regulations particularly in regard to compliance with Sections 23A and 23B of the Federal Reserve Act, the Federal Reserve Board's Regulation O, BSA Rules, and state branch banking laws;
3. Operating the Bank with an ineffective BSA/Anti-Money Laundering (œAML) Compliance Program;
4. Operating the Bank with an ineffective system of internal controls to ensure compliance with the BSA Rules;
5. Operating the Bank with an ineffective BSA/AML training program to ensure compliance with the BSA Rules;
6. Operating the Bank with an ineffective BSA officer to properly direct, administer, and oversee the BSA program; and
7. Operating the Bank with an ineffective Customer Due Diligence Program (œCDD) to ensure compliance with the BSA Rules.

• Part 103 of the Treasury Department's Financial Record-keeping and Reporting of Currency and Foreign Transactions Regulation, 31 C.F.R. Part 103 §§ 18-38; and
• Part 326, Subpart B-Procedures for Monitoring Bank Secrecy Act Compliance, 12 C.F.R Part 326 §326.8.

• Within 60 days of the effective date of this ORDER, the board shall revise the Bank's Bank Secrecy Act (BSA) and Anti-Money Laundering (AML) program to address deficiencies and violations set forth in the Report of Examination.
• The Bank's revised BSA and AML compliance programs shall ensure the Bank's future compliance with the BSA and related rules and regulations, including Part 103 of the Treasury Department's Financial Record-keeping and Reporting of Currency and Foreign Transactions Regulation, 31 C.F.R. Part 103 §§ 18-38; Part 326, Subpart B-Procedures for Monitoring Bank Secrecy Act Compliance, 12 C.F.R Part 326 §326.8; and Part 353 of the FDIC's Rules and Regulations, 12 C.F.R. Part 353. At a minimum, the revised and enhanced compliance programs shall include the following:
  • establishment and documentation of training on a regular and on-going basis for management and Institution personnel on all relevant aspects of laws, regulations, and Institution policies and procedures relating to the BSA and OFAC compliance programs, with a specific concentration on the currency and monetary instruments reporting requirements;
  • procedures for the Institution's customer identification program and account opening procedures;
  • procedures regarding the identification and reporting of cash transactions;
  • procedures for transactions involving non-customers, including, but not limited to, wire transfer services, traveler's check services, and foreign exchange services; and
  • independent annual testing for compliance with the BSA in accordance with the procedures described in section 326.8 of the FDIC Rules and Regulations, 12 C.F.R. § 326.8.

• Operating the Bank with an ineffective system of internal controls to ensure ongoing compliance with the BSA.
• Operating the Bank without a qualified BSA Officer.
• Operating the Bank with an ineffective training program for appropriate Bank personnel to ensure compliance with the BSA.
• Operating the Bank without an adequate independent test commensurate with the level of BSA risk.
• Operating in violation of section 326.8, of the FDIC's Rules and Regulations, 12. C.F.R. § 326.8, and the Treasury Department's Financial Recordkeeping Regulations, 31 C.F.R. Part 103.
• Operating the Bank without effective risk assessment policies and practices to assure compliance with Office of Foreign Assets Control (OFAC) regulations and policies.
• Operating the Bank with management whose practices have resulted in violations of law and regulation.
• Operating with inadequate internal controls, policies, and operating systems with regard to Money Services Businesses (MSBs), as that term is defined at Section 31 C.F.R. § 103.11.

• "Operating in violation of the Bank Secrecy Act, as amended, 12 U.S.C. § 1829b, 12 U.S.C. §§ 1951-1959, and 31 U.S.C. §§ 5311-5332, and implemented by rules and regulations issued by the United States Department of Treasury, 31 C.F.R. Part 103, and the FDIC, 12 C.F.R. § 326.8 (hereafter collectively œBSA);
• "Operating in violation of section 326.8(c)(3)of the FDIC's Rules and Regulations, 12 C.F.R. § 326.8(c)(3) [which required the designation of an individual or individuals responsible for coordinating and monitoring day-to-day compliance with the BSA requirements];
• "Operating in violation of section 353.3(e) of the FDIC's Rules and Regulations, 12 C.F.R. § 353.3(e) [retention of SAR file records];
• "Operating in violation of section 353.3(f) of the FDIC's Rules and Regulations, 12 C.F.R. § 353.3(f) [reporting of SARs to board of directors];
• "Operating with inadequate management supervision and oversight by the Board to prevent unsafe or unsound practices and violations of law and regulation, including violations of the BSA."

1. appoint a Compliance Committee of at least three of its directors, no more than one of whom may be an insider or family member of an insider.
2. develop, implement and ensure bank adherence to a written program of policies and procedures for
   • compliance with the BSA and regulations issued thereunder
   • monitoring of suspicious cash, monetary instruments, wire transfers and other activities for all types of transactions, accounts, customers, products, services and geographic areas
3. develop, implement, and ensure bank adherence to expanded account-opening procedures for all accounts that pose greater than normal risk for compliance with the Bank Secrecy Act, and obtain the information required by these procedures before renewing or modifying an existing customer's account
4. develop, implement and ensure bank adherence to a policy determining when the bank will not open, block use of or close an account (and file appropriate SARs) if the information required by bank policy for opening or maintaining account is not supplied, if the bank doesn't have a reasonable belief that it knows its customer's true identity, or the bank determines that continuing the relationship would be detrimental to the bank's reputation
5. develop, implement and maintain an integrated system for all bank areas to identify unusual or suspicious activity
6. ensure that the bank's BSA officer periodically reviews (at least annually) all account information for high risk accounts (and related accounts) to determine whether account activity is consistent with the customer's business and the stated purpose of the account
7. ensure that the bank has processes, personnel and control systems to implement and adhere to the program for compliance.
   
   

• Failure to establish and implement an anti-money laundering program with internal controls and other measures reasonably designed to prevent the money services business from being used to facilitate money laundering
• Multiple failures to timely file currency transaction reports, as required by the Bank Secrecy Act and its implementing regulations
• Despite actual knowledge of the requirements of the Bank Secrecy Act, EI Noa Noa continued to operate for an extended period of time without an effective anti-money laundering program. As of February 2005, EI Noa Noa still had not established and implemented a written anti-money laundering program.
• EI Noa Noa failed to file a total of 66 currency transaction reports, in the aggregate amount of $1,025,948, from January 1,2004 through May 31,2005. EI Noa Noa failed to file 61 currency transaction reports on single check cashing transactions in excess of $10,000, in the amount of $963,438, and five currency transaction reports on multiple check cashing transactions in the amount of $62,510.

• operating in violation of section 326.8 of the FDIC Rules and Regulations, 12 C.F.R. § 326.8, regarding a satisfactory Bank Secrecy Act (œBSA) and Anti-Money Laundering (œAML) compliance program; and
• operating in violation of section 353.3 of the FDIC Rules and Regulations, 12 C.F.R. § 353.3, regarding Suspicious Activity Report (œSAR) procedures to identify, monitor, and report suspicious activities.

• operating in violation of section 326.8 of the FDIC's Rules and Regulations, 12 C.F.R. § 326.8, regarding a satisfactory Bank Secrecy Act (œBSA) and Anti-Money Laundering (œAML) compliance program with respect to Individual Retirement Accounts administered by third parties;
• operating in violation of section 353.3 of the FDIC's Rules and Regulations, 12 C.F.R. § 353.3, regarding Suspicious Activity Report (œSAR) procedures to identify, monitor, and report suspicious activities with respect to Individual Retirement Accounts administered by third parties;
• operating without adequate customer due diligence with respect to Individual Retirement Accounts administered by third parties.

• develop, adopt, and maintain a written customer due diligence program that includes
  • a risk focused assessment of the customer base of the bank to determine appropriate levels of enhanced due diligence for higher risk customers
  • for high-risk customers, procedures to determine appropriate documentation to confirm identity and business activities, understand the normal and expected transactions of the customer, and reasonably ensure identification and timely, accurate and complete reporting of known or suspected criminal activity against or involving the bank.
• advise the bank's directors of significant SARs, with detailed reports of any SARS involving employees, contractors, officers and directors.

• stop processing wire transfer (including ACH, Fedwire and other electronic means), dollar draft and pouch transactions for non-customers immediately , and within 45 days for customers.
  • "dollar draft" means a draft or check in U.S. dollars, available at foreign financial institutions and drawn on a U.S. correspondent account by a foreign financial institution.
  • "pouch transaction" includes the transportation of currency, monetary instruments and other negotiable instruments from outside the U.S. to the federal branch, and the processing such instruments, including money orders, traveler's checks and bank checks.
• engage a qualified and approved consultant to review all wire transfer and dollar draft activity at the federal branch of UBA from 1/1/2007 to 2/29/2008 (or such extended period as the OCC may require), to ascertain any unusual or suspicious transactions. The UBA must file any CTRs or SARs required for any previously unreported activity revealed in that review.
• update within 30 days and at least annually thereafter, a written comprehensive BSA risk assessment.
• revise and implement a written program for internal controls and processes to ensure compliance with SAR filing requirements.
• outsource the internal audit of all operations and compliance functions of the federal branch to a qualified independent third party.

• Operating the Bank in violation of the Currency and Foreign Transactions Reporting Act (31 U.S.C. § 5311 et seq.) (the Bank Secrecy Act) (œBSA), the rules and regulations implementing the BSA issued by the U. S. Department of the Treasury (31 C.F.R. Part 103) (œFinancial Recordkeeping), and the FDIC's BSA Rules and Procedures Regulations, 12 C.F.R. Part 326; and the FDIC's Suspicious Activity Reports (œSARs) regulations, 12 C.F.R. Part 353 (all the rules referred to in this paragraph are referred to hereinafter, collectively, as œBSA Rules);
• Operating the Bank without adequate supervision and direction by the Bank's board of directors and senior management of the Bank to prevent unsafe and unsound banking practices and violations of Federal and State laws or regulations and to ensure compliance with the BSA Rules;
• Operating the Bank with an ineffective BSA/Anti-Money Laundering (œAML) Compliance Policy;
• Operating the Bank with an ineffective system of internal controls to ensure compliance with the BSA Rules;
• Operating the Bank with an ineffective BSA/AML training program to ensure compliance with the BSA Rules;
• Operating the Bank with an ineffective Customer Identification Program (œCIP) for accounts for persons other than individuals;
• Operating the Bank with an ineffective Customer Due Diligence Program (œCDD) to ensure compliance with the BSA Rules;
• Operating the Bank without an effective system of independent testing to ensure compliance with the BSA Rules; and
• Operating the Bank with an ineffective audit policy to ensure compliance with the BSA Rules.

• operating in violation of the Bank Secrecy Act, 31 U.S.C. § 5311 et seq., 12 U.S.C. § 1829b and 12 U.S.C. §§ 1951-1959, and its implementing regulation, 31 C.F.R. Part 103, and 12 U.S.C. § 1818(s) and its implementing regulation, 12 C.F.R. § 326.8 (collectively referred to as œBSA);
• operating with an inadequate BSA/Anti-Money Laundering Compliance Program (œBSA/AML Compliance Program) to monitor and assure compliance with the BSA; and
• operating with ineffective policies, procedures and processes to adequately screen, monitor and verify account transactions to ensure compliance with the regulations promulgated by the United States Department of Treasury's Office of Foreign Assets Control (œOFAC), 31 C.F.R. Part 500, as well as all statutes, regulations, rules and/or guidelines issued or administered by OFAC (œOFAC Provisions).

1. designate a qualified officer responsible for managing, coordinating and monitoring the bank's BSA and OFAC compliance programs.
2. perform a comprehensive assessment of the vulnerability of its banking operations to attempts to launder money, finance terrorism, or conduct other criminal activities (œBSA/Anti-Money Laundering (œAML) risk assessment).
3. perform a comprehensive assessment of its OFAC risk profile (œOFAC risk assessment).
4. develop, adopt, and implement a revised, written BSA/AML compliance program designed to ensure compliance with the BSA, tailored to address the risk profile of the Bank identified in the BSA/AML risk assessment required above.
5. develop, adopt and implement a revised, written program and procedures to ensure compliance with outstanding OFAC sanctions (œOFAC compliance program), tailored to address the OFAC risk profile of the Bank identified in the OFAC risk assessment required above.
6. independently test its revised BSA/AML and OFAC compliance programs to ensure proper controls are in place and are effective.
7. enhance and update its training program to provide for periodic BSA/AML/OFAC training for Bank personnel and appropriate recordkeeping to document such training.
8. develop, adopt, and implement a revised, written Customer Identification Program.
9. search required records pursuant to "314(a)" requirements, including FinCEN 314(a) requests for the preceding 12 months of the effective date of the order and going forward.

• Failure to adopt and implement comprehensive customer due diligence and enhanced due diligence processes, particularly regarding high risk customers.
• Failure to maintain effective control measures for bearer share and other PICs.
• Failure to adhere to bank's own written policies requiring periodic reviews of high risk accounts.
• The bank's transaction monitoring system continued to be inadequate to the task, due to data integrity and other problems. System-identified potentially suspicious activity was not properly resolved, so the bank could not identify, monitor and report suspicious activity.
• AEBI did not perform satisfactory independent testing of its BSA/AML program. In particular, the bank's internal audit function didn't review implementation of the bank's automated transaction monitoring system.
• Failure to provide for adequate oversight of and accountability for the BSA/AML compliance program by management of AEBI and by its parent company, AEB, which had agreed to provide oversight.

• Operating with management whose policies and practices are insufficient to prevent violations of the Bank Secrecy Act, 31 U.S.C. §§ 5311 et seq., and implementing regulations including 12 C.F.R. Part 326 and Part 353, and 31 C.F.R. Part 103 (hereafter collectively œBank Secrecy Act or œBSA);
• Operating with inadequate policies and procedures reasonably designed to identify and report suspicious activities to Bank directors and others;
• Operating without an effective system of independent testing for compliance with BSA requirements;
• Operating without an adequate BSA training program for appropriate Bank personnel; and
• Violating BSA law(s) and regulation(s), including:
  • Part 103 of the Treasury Department's Financial Record-keeping and Reporting of Currency and Foreign Transactions Regulation, 31 C.F.R. Part 103; and
  • Sections 326.8 and 353 of the FDIC Rules and Regulations, 12 C.F.R. §§ 326.8 and 353, respectively.

• operating without adequate oversight by the Bank's board of directors and supervision by executive management to prevent violations of the Bank Secrecy Act, 31 U.S.C. § 5311-5330, 12 U.S.C. § 1829b, and 12 U.S.C. § 1951 “ 1959, and regulations implementing the Bank Secrecy Act, including 12 C.F.R. Part 326, Subpart B, 12 C.F.R. Part 353, and 31 C.F.R. Part 103 (collectively referred to as œBSA);
• failing to develop and continually administer a BSA compliance program;
• operating without an effective system of internal controls to ensure ongoing compliance with the BSA, including but not limited to adequate information and communications systems to monitor and ensure compliance with recordkeeping requirements for BSA reporting;
• operating without an effective system of independent testing for compliance with the BSA;
• operating without an adequate BSA training program for the Bank's directors and appropriate personnel;
• operating without an effective customer identification and verification system that complies with section 103.121 of the Rules and Regulations of the Department of the Treasury, 31 C.F.R. § 103.121;
• failing to develop and implement an adequate system for detecting and reporting suspicious activity; and
• violating laws and regulations, including:
  • failing to develop and continually administer a BSA compliance program as required by section 326.8(b) of the FDIC's Rules and Regulations, 12 C.F.R. § 326.8, including but not limited to an adequate Customer Identification Program, a system of internal controls sufficient to ensure ongoing compliance with the BSA, a system of independent testing, and adequate training of appropriate personnel;
  • failing to comply with the Treasury Department's Financial Recordkeeping and Reporting of Currency and Foreign Transactions regulation, 31 C.F.R. Part 103, including but not limited to failing to file Currency Transaction Reports (œCTRs), failing to file CTRs in a timely manner, failing to furnish required information in CTRs, failing to aggregate multiple transactions totaling over $10,000 for reporting purposes, failing to perform annual reviews of exempt persons and document monitoring of exempt person transactions, failing to properly conduct records searches upon the request of the Financial Crimes Enforcement Network (œFinCEN), failing to follow required identification procedures for reported transactions, failing to obtain required customer identification information, and failing to verify customer identification information; and
  • failing to file Suspicious Activity Reports (œSARs) as required by 12 C.F.R. § 353.3(a)(4) for transactions structured to evade BSA reporting requirements.

• Within 60 days, designate a qualified officer responsible for managing, coordinating, and monitoring the Insured Institution's Bank Secrecy Act (œBSA) and Office of Foreign Assets Control (œOFAC) compliance programs ("BSA Officer"). The BSA Officer shall have the responsibility and necessary authority to ensure the Insured Institution's compliance with the BSA and OFAC rules and regulations and related matters, including, without limitation, the identification of timely, accurate, and complete reporting to law enforcement and supervisory authorities of unusual or suspicious activity or known or suspected criminal activity perpetrated against or involving the Insured Institution.
• Within 120 days, the BSA Officer shall review the Insured Institution's BSA and OFAC compliance program deficiencies and violations set forth in the Report of Examination.
• The Insured Institution's BSA and OFAC compliance programs shall ensure the Insured Institution's future compliance with the BSA and OFAC rules and regulations, section 326.8 and Part 353 of the FDIC Rules and Regulations, 12 C.F.R. § 326.8 and 12 C.F.R. Part 353, and with any related rules and regulations. At a minimum, the compliance programs shall include the following:
  • Procedures for the Insured Institution's customer identification program and account opening procedures;
  • Policies and procedures with respect to high-risk accounts and customers, including the adequacy of methods for identifying and conducting due diligence on high-risk accounts and customers at account opening and thereafter, and for monitoring high-risk client relationships on a transaction basis as well as by account and customer;
  • Policies, procedures, and systems for identifying, evaluating, monitoring, investigating, and reporting suspicious activity, including transactions involving high-risk customers or accounts and/or high-risk jurisdictions, and the appropriateness of the Insured Institution's criteria for designating an account as high risk and assessing the Insured Institution's procedures and systems for identifying and monitoring customer transactions in accordance with rules and regulations of the BSA and OFAC;
  • Policies and procedures regarding the identification and reporting of cash transactions;
  • Policies and procedures with respect to wire transfer recordkeeping requirements;
  • Policies and procedures for transactions involving non-customers, including, but not limited to, wire transfer services, traveler's check services, and foreign exchange services;
  • Independent annual testing for compliance with the BSA in accordance with the procedures described in section 326.8 of the FDIC Rules and Regulations, 12 C.F.R. § 326.8; and
  • Establishment and documentation of training on a regular and on-going basis for management and Insured Institution personnel on all relevant aspects of laws, regulations, and Insured Institution policies and procedures relating to the BSA and OFAC compliance programs, with a specific concentration on the currency and monetary instruments reporting requirements and the reporting requirements associated with Suspicious Activity Reports, Currency Transaction Reports, and processing requirements of OFAC.

• Operating the Bank without effective supervision by the board of directors and executive management to prevent unsafe or unsound practices and violations of law and regulations related to the Bank Secrecy Act, 31 U.S.C. §§ 5311-5330, and regulations implementing the Bank Secrecy Act, including 12 C.F.R. Part 326, Subpart B, and 31 C.F.R. Part 103 (hereinafter collectively, œBank Secrecy Act);
• Operating the Bank with an ineffective system of internal controls to assure ongoing compliance with the Bank Secrecy Act;
• Operating the Bank with an ineffective training program for appropriate Bank personnel to assure compliance with the Bank Secrecy Act;
• Operating in violation of section 326.8, of the FDIC's Rules and Regulations, 12. C.F.R. 326.8, and the Treasury Department's Financial Recordkeeping Regulations, 31 C.F.R Part 103, more fully described [in a joint FDIC/KOFI report of exam dated] February 27, 2007;
• Operating with management whose actions and practices have resulted in violation of law and regulation relating to Bank Secrecy Act compliance; and
• Operating with a board of directors which has failed to provide adequate supervision over and direction to the management of the Bank to prevent violations of law and regulation relating to Bank Secrecy Act compliance.

• Operating in violation of the Currency and Foreign Transactions Reporting Act (31 U.S.C. § 5311 et seq.) (the Bank Secrecy Act) (œBSA), the rules and regulations implementing the BSA issued by the U.S. Department of the Treasury (31 C.F.R. Part 103) (œFinancial Recordkeeping), the FDIC's BSA Programs and Procedures Regulations, 12 C.F.R. Part 326 (œBSA Programs and Procedures), and 12 C.F.R. Part 353 (œSuspicious Activity Reports); and
• Operating with a board of directors that has failed to provide adequate supervision over and direction to the management of the Bank to prevent unsafe or unsound banking practices and violations of laws or regulations.

• Engage a qualified third party consultant to assist in correcting program deficiencies.
• Complete a comprehensive BSA/AML risk assessment.
• Develop and maintain a list of high and moderate risk members.
• Back-file CTRs and SARs, including CTRs on improperly exempted businesses.
• Implement policies to require documenting decisions not to file SARs.
• Ensure SAR filings are kept confidential.
• Establish written high-risk member policies and procedures within 90 days.
• Hire a competent full-time BSA Compliance Officer with requisite authority and resources to ensure compliance.
• Create a BSA compliance team, and dedicate sufficient staffing and resources to BSA/AML compliance, based on a written risk assessment.
• Cross-train staff to ensure BSA compliance program continuity.
• Obtain and research all 314(a) information sharing requests from FinCEN within 14 days of their receipt. Include 314(a) compliance in BSA Compliance Policy.
• Develop and maintain a comprehensive BSA/AML training program within 90 days.
• Develop and maintain risk-based internal controls and transaction monitoring tools for identification of reportable transactions.
• Evaluate and strengthen current CIP verification processes. Expand CIP procedures to identify higher risk members, for due diligence and account monitoring.
• Develop written procedures to direct responses to law enforcement subpoenas, notifications, requests or inquiries.
• Require organized maintenance of all notifications from law enforcement and government agencies in a secure and readily-retrievable manner.
• Engage a qualified independent third party to conduct BSA/AML compliance program independent testing within 120 days.
• Review current exempt person designations for appropriateness, and document reasons for all continuing exemptions.
• Make a monthly check of all credit union members against the OFAC SDN list.
• OFAC training for all credit union officials, including staff, management and board members.

• revise, renew, adopt and implement a written BSA compliance program that
  • establishes a system in internal controls to ensure compliance, particularly policies and procedures to detect and monitor suspicious transactions
  • provides for independent testing of BSA compliance, at least annually
  • ensures that the bank's BSA compliance program is managed by a qualified officer with requisite authority, responsibility, training, resources, and a management reporting structure to ensure compliance
  • Provides and documents BSA/AML training of all board members and appropriate personnel
• develop, adopt and implement an effective EDD program that will
  • conduct a risk-focused assessment of the bank's customer based to determine appropriate levels of EDD needed for higher-risk categories of customers
  • develop procedures to determine appropriate documentation confirming the identity and business activities of high-risk customers, and to effectively monitor those customers' activities to identify and report suspicious activity
  • be reviewed regularly to ensure that the bank obtains and used information sufficient for the proper operation of an automated suspicious activity monitoring system (described below).
• enhance its system to allow for periodic review of customer transactions to identify suspicious activity, so that the system can
  • consider cash transactions, wire transfers, and monetary instrument purchases or negotiations
  • utilize relevant customer data to link related businesses, accounts, and relationships, to facilitate the sorting and review of multiple transaction types and transactions over extended periods of time
  • reasonably detect structured transactions and transactions having no business or apparent lawful purpose, and those not customary for a customer.
• develop a plan to complete a six-month look-back on all high and medium-risk accounts for suspicious activity, to file any additional SARs deemed necessary based on the review, and to report on the results of the review and SAR filings to the bank's board, the FDIC and the state Commissioner.
• implement, customize and test any BSA/AML related modules in its existing or new software system so that the bank can have a fully functioning automated system for detecting and monitoring suspicious activity. This automated system should analyze cash transactions over a threshold amount, wire transfers, EFTs and monetary instrument purchases and deposits, with central review and full documentation of decisions for all flagged items.

• Operating in violation of the BSA, Treasury regulations at 31 CFR Part 103, the FDIC's BSA Programs and Procedures regulations at 12 CFR Part 326, and the FDIC's Suspicious Activity Reports regulations at 12 CFR Part 353.
• Operating with a board of directors that had failed to provide adequate supervision over and direction to bank management to prevent unsafe or unsound banking practices and violations of law and regulations.

• Have and retain a qualified BSA officer, with appropriate authority, and notify the FDIC and state banking commissioner of any changes in the bank's BSA officer
• Complete an independent review of senior bank staff to assist the bank in achieving and maintaining a management and reporting structure for BSA compliance appropriate to the bank's size and risk profile
• Establish procedures to review the bank's customer base to identify MSBs, to ensure that appropriate information is gathered on MSB customers, and to identify potential MSBs in daily monitoring procedures
• Employ a qualified independent consultant to complete a customer risk assessment, to include
  • an analysis of the bank's risk assessment for customers classified as MSBs, taking into consideration the 4/26/05 interagency guidance on providing banking service to MSBs
  • the money laundering and terrorist financing risks associated with the bank's customers, business lines, departments, products, safekeeping services, location, and markets served
• Adopt a comprehensive, written BSA Program based on the independent risk assessment including
  • an effective system of internal controls to ensure compliance, to include ten specific elements
  • a training program for all operational personnel with a need for BSA knowledge
  • delivery of an overview of BSA requirements to all new employees within 30 days of hire, and to all bank executives and directors
  • independent testing by an outside consultant to ensure proper controls are in place to comply
• Take all reasonable steps, within 30 days of the order, to eliminate all apparent violations identified in the bank's 10/30/06 Report of Examination
• Establish a board committee charged with ensuring the bank complies with the order.
• Furnish its shareholders a description of the order

1. Bring itself into compliance with "the BSA and its rules regulations" within 90 days of the Order.
2. Within 60 days of the Order, correct all alleged violations of Parts 326 and 353 listed in an October 18, 2006, Report of Examination
3. Update its written compliance program to ensure and maintain compliance with the BSA and related rules and regulations. The update must continue to improve the banks' system of internal controls for BSA compliance.
4. Revise, adopt, and implement an effective wirtten customer due diligence program.
5. Review all high-risk accounts and transactions, including CTRs, cash purchases of monetary instruments, wire transfer activity and foreign exchange services for the six months starting 6/1/06 (this is the six months prior to full implementation of a purchased automated program to aid in similar reviews)
6. File any additional CTRs and SARs needed, based on that review
7. Improve and implement an effective CIP

• Operating in violation of section 326.8 of the FDIC's rules and regulations (BSA compliance).
• Operating in violation of section 353.3 of the FDIC's rules and regulations (SAR filing requirements).

• Develop, adopt and implement a written BSA compliance program.
• Develop, adopt and implement a written customer due diligence program, to include enhanced due diligence for appropriate customers.
• Develop and execute a plan to review high risk accounts and transactions in the bank's Los Angeles branch to identify any CTRs and SARs that should have been filed and were not. The review is to cover the period from the opening of the branch to the implementation of the bank's automated suspicious activity monitoring system.
• Establish and implement policies and procedures to advise directors of significant SARs and advise the audit committee of all SARs.
• Provide for audit committee oversight of BSA compliance, and for reports at least monthly to the audit committee, and report by the audit committee on BSA matters at each board meeting.
• Provide for internal data processing reports to facilitate BSA monitoring and CTR reporting.
• Develop a risk profile for each business are and for the bank as a whole, with input for all branches, management and departments.
• Consolidate and standardize all existing BSA policies and procedures.
• Provide for comprehensive independent tests of compliance with the BSA and related regulations.
• Inform its shareholders of the order in its next shareholder communication and with its next proxy statement or notice of a shareholder meeting (this appears to be a standard requirement for C&D orders).

• Operating in violation of the Currency and Foreign Transactions Reporting Act, the Bank Secrecy Act, Treasury rules at 31 CFR Part 103, FDIC's BSA Programs and Procedures regulations (12 CFR 326) and SAR regulations (12 CFR 353) -- collectively, the "BSA Rules."
• Operating without effective board of directors oversight and management supervision to prevent violations of law relating to the BSA rules.
• Operating with an ineffective system of internal controls to ensure ongoing compliance with BSA rules.
• Operating with an ineffective Customer Due Diligence Program, to ensure compliance with the BSA rules.
• Operating with an ineffective system of independent testing to ensure compliance with the BSA rules.
• Operating with an ineffective BSA rules training program for appropriate bank personnel.

• Operating without effective board of directors oversight and management supervision to prevent violations of law relating to the BSA and OFAC regulations.
• Operating with an ineffective system of internal controls to ensure ongoing compliance with BSA/OFAC rules.
• Operating without effective coordinating and monitoring procedures by a designated individual responsible for ensuring day-to-day compliance with the BSA/OFAC rules.
• Operating without an effective CIP.

• Within 60 days of the order, develop, adopt, and implement a written plan for compliance with BSA/OFAC rules and CIP, including
  • a system of internal controls, policies and procedures to detect and monitor transactions to ensure compliance with BSA rules, specifically addressing the opening and monitoring of accounts with frequent wire and check activity.
  • procedures for CIP and account opening
  • policies and procedures for high-risk accounts and customers, and for monitoring high-risk client relationships on a transaction basis and by account and customer
  • policies, procedures and systems for identifying, evaluating, monitoring, investigating, and reporting suspicious activity, particularly involving high risk customers or accounts and high risk jurisdictions
  • policies and procedures regarding identification and reporting of cash transactions.
  • policies and procedures on wire transfer recordkeeping requirements
  • designation of a senior bank official as BSA Officer, responsible for coordinating and monitoring day-to-day compliance with BSA/OFAC rules. This individual will report directly to a board BSA committee (see below).
  • adequate, qualified staffing for BSA compliance.
  • independent annual testing for compliance with the BSA
  • appropriate training for the bank relating to BSA/OFAC rules.
• Within 60 days of the order, review, enhance and implement a written customer CIP, to be approved by regulators.
• Within 30 days, establish a board committee of at least five members (with a majority being non-officers of the bank), to oversee compliance with BSA/OFAC rules.
• Within 120 days of the order, update the bank's overall BSA risk assessment.
• Within 90 days of the order, revise bank BSA policy to provide for
  • risk rating of customers
  • comprehensive monitoring of high-risk accounts, with full use of account monitoring software
  • systems for account aggregation to ensure sufficient data to determine whether SARs and CTRs should be filed
  • methods for maintaining and controlling documentation and monitoring accounts of the private banking department, including embassy and PEP accounts, entities with bearer shares, foreign nationals, private investment companies and other offshore entities
  • procedures for handling pouch transactions under appropriate controls
  • standards for opening accounts
  • methods for enforcing the bank's policies regarding BSA/OFAC rules.
• Within 60 days, implement a written customer due diligence program.

• operating in violation of the Bank Secrecy Act and implementing regulations.
• operating with inadequate management supervision and oversight by its board of directors to prevent unsafe or unsound practices and violations of the BSA.
• operating with an inadequate BSA/AML compliance program.
• failure to have an adequate written CIP.
• operating with inadequate internal controls for BSA compliance.
• operating with inadequate system for independent testing for BSA compliance.
• failure to provide adequate BSA training.
• operating with ineffective policies, procedures and processes ("3P") to comply with 31 CFR Part 103.
• operating with ineffective 3P for screening, monitoring and verifying account transactions for OFAC compliance.

• develop, adopt and implement a system of internal controls for compliance with the BSA, to include policies, procedures and processes on-
  • BSA/AML risk assessments to be conducted immediately and every 12 to 18 months thereafter
  • Customer due diligence, in conjunction with CIP
  • High risk account identification and monitoring
  • Enhanced due diligence for high-risk customers
  • Large cash transaction/funds transfers/monetary instrument monitoring for suspicious activity
  • Monitoring, detecting and reporting suspicious activity.
  • Customer exemptions from CTR filing
  • CIP
  • BSA/AML staffing and resources
  • wire transfer transactions
• develop, adopt and implement internal controls to ensure compliance with OFAC regulations taking into consideration its customers, their geographic locations, the types of accounts, products and services offered, and the geographic areas in which they are offered
• establish independent testing programs for compliance with BSA and OFAC regulations, at least annually, using audit procedures and auditors with experience commensurate with the bank's BSA/AML risk level.
• deliver responsibility-specific BSA/OFAC training to all personnel, including directors and management.
• designate a qualified BSA and OFAC officer or officers.
• develop, adopt and implement policies, procedures and processes to comply with section 314(a) of USAPA.
• include reviews of compliance with BSA and OFAC rules in routine internal and external audits (in addition to independent testing)
• periodically report to the bank's Audit Committee any law enforcement inquiry relating to BSA or OFAC, and criminal subpoena received, and any action taken or response provided to such inquiry or subpoena.
• engage a qualified independent firm to "look back" to review account and transaction activity from 1/1/2006 to the date of the order to determine if suspicious activity within or through the bank was properly identified and reported, and
• complete the filing of any omitted SARs.

• Engage, within 30 days, a consultant to assist in correcting BSA/AML program deficiencies.
• Complete, within 30 days, a comprehensive BSA/AML risk assessment, including the development of a list of high and moderate risk members.
• Ensure that high-risk member account activity is reviewed monthly, and moderate risk member activity is reviewed quarterly.
• Designate a full-time, competent BSA Compliance Officer within 10 days of the order, and train that individual.
• Within 30 days of the order, approve and submit to NCUA a detailed job description for the BSA Officer.
• Enhance monitoring of cash transactions and outgoing wires.
• Improve internal controls and monitoring tools to ensure that all reportable transactions are identified. Include sales and redemptions of monetary instruments, incoming wires, ATM transactions and others identified in the Risk Assessment.
• Ensure that CTRs and SARs are timely, accurately, and completely filed.
• Within 15 days, start using FinCEN's BSA Direct E-filing system.
• Maintain security and secrecy of SARs.
• Within 60 days, complete the back filing of CTRs and SARs to 2001. Consider hiring temporary help to assume routine credit union assignments so that knowledgeable staff may complete this review.
• Complete a monthly check of member names against the OFAC SDN list.
• Train personnel on use of the credit union's OFAC software.
• Train all staff and officials, including board members, on OFAC requirements within 30 days.
• Research FinCEN § 314(a) requests on a timely basis. Obtain missed requests and search records within 10 days and weekly thereafter.
• Establish written CIP processes, including the verification of tax ID numbers.
• Ensure timely and accurate follow up on IRS report errors or mismatch notifications.
• Verify SSNs, EINs and ITINs for all members joining since 1/1/2000, and file SARs for any that cannot be verified within 90 days.
• Identify all members who are MSBs, and establish an effective MSB monitoring program, within 30 days. Close all MSB accounts for which due diligence cannot be completed in that time frame.
• Ensure that all business accounts -- and personal accounts with business activity -- are identified within 90 days.
• Within 60 days, develop and implement due diligence and monitoring processes for business accounts.
• Within 45 days, develop and implement a comprehensive BSA/AML "top to bottom" training program<
• Within 120 days, engage a qualified independent third party for independent testing of the BSA/AML compliance program, to be completed within 180 days. Ensure annual independent testing thereafter.

• an enhanced customer due diligence procedures for all "higher-risk" customers, to be employed prior to account opening for new accounts of such customers.
• additional employee training to facilitate identification of structured and other suspicious transactions, and the prompt and accurate filing of SARs.
• effective independent testing for [BSA] compliance.
• timely corrective action regarding other BSA-related comments in the most recent Report of Examination.

• Violated the BSA and 31 CFR 103.33(a) [records of loan transactions] by permitting CMG to maintain records that frequently failed to adequately identify a legitimate business purpose for loans, or fully and adequately describe the nature and purpose of loans (loans were described merely as being for "working capital").
• Failed to maintain a system of controls to monitor and report suspicious activity.
• Failed to adequately identify and monitor accounts of politically-exposed persons (PEPs).
• Failed to monitor loans accounts and payments for suspicious activity.
• Did not have an adequate training program on detecting and reporting suspicious activity.
• Permitted CMG to make loans that did not conform to the bank's own lending policies, and to omit obtaining proper authorization for large credits.
• Allowed CMG to provide incomplete or inadequate loan documentation and recordkeeping, not in accordance with bank policies.
• Failed to do adequate customer due diligence, especially for high-risk customers.
• Allowed CMG to maintain an inadequate record of its securities transactions.
• Permitted OMG to engage in securities transactions in violation of OCC regulations.
• Allowed CMG to conduct securities transactions with high-risk countries without risk management procedures.

• Failed to conform to its own established anti-money laundering procedures with respect to 34 high-risk accounts involving trust and private investment corporations apparently linked to one family and domiciled in the Isle of Man (noted for its acceptance of offshore banking). These accounts engaged in multi-million-dollar international wire transfers. It is stated that BAI
  • Failed to require the names of beneficial owners.
  • Failed to restrict activity in the accounts, in spite of not knowing the beneficial owners.
  • Permitted international wire transfers without knowing the beneficial owners of the accounts.
  • Ignored advice from an in-house senior lawyer that the names of the beneficial owners should be obtained.
  • Ignored its own risk committee's determination that the names must be obtained.
  • Ignored repeated requests from its clearing firm for the beneficial owner information.
  • Ignored notices from its clearing firm pointing out indicia of money-laundering activity.
• Had an inadequate compliance program for reporting suspicious transactions. BAI relied on its parent bank to determine whether SARs should be filed, but communications between BAI and its parent were inadequate for that purpose.

• Provide for compliance with the BSA and with regulations at 31 CFR Part 103 and 12 CFR Part 21, and the rules and regulations of OFAC (collectively, "BSA").
• Perform, within 45 days and at least annually thereafter, a written comprehensive BSA risk assessment consistent with guidance in the 2006 FFIEC BSA/AML Examination Manual.
• Within 90 days, develop a comprehensive written BSA Program, including
  • internal controls, independent testing and auditing to ensure compliance with BSA, OFAC and CIP requirements
  • identification of beneficial owners of all depository and loan accounts at the branch
  • a process for linking accounts across business lines to evaluate activity patterns
  • procedures to ensure CTRs are filed as required
  • definitions and guidance for identification of high risk accounts, including embassy and PEP accounts
  • procedures, including due diligence, for opening new accounts, with particular attention to
    • money remitters and money service businesses
    • embassy and PEP accounts
    • import/export companies
    • jewelry and precious metal dealers
    • foreign exchange businesses
    • off shore corporations
    • accounts with wire transfer, demand draft or pouch activity
  • improved monitory for credits at the New York branch to ensure managers understand ownership structures or its obligors and can detect affiliated relationships
  • improved due diligence procedures for foreign correspondent accounts
  • recordkeeping on funds transfers, as required by the BSA
  • procedures designed to enhance detection and reporting of suspicious activity patterns
  • a training program to ensure awareness of an compliance with BSA and OFAC requirements, including CTRs, monetary instrument and funds transfer recordkeeping, and SARs
  • delegation of responsibility for filing CTRs and CMIRs
  • guidelines on certifications for foreign correspondent accounts
• Within 30 days, develop and implement a written program and system of internal controls to ensure compliance with requirements to file SARs
• Within 60 days, outsource the branch's internal audit of operational and compliance functions to an independent third party.
• Within 60 days, stop processing transactions for non customers until the branch has established and received approval for policies, procedures and controls to ensure due diligence and reporting of transactions under the BSA of suspicious activity.
• Immediately cease transporting negotiable instruments and cash off branch premises except by bonded courier, and in accordance with the branch's BSA policies and procedures.

• Failure to fully investigate activity of three of its 40 MSB customers to determine if it was suspicious. The three collectively withdrew over $615 million in cash over 18 months.
  • Bank received federal subpoenas, so it had knowledge customers were being investigated.
  • Bank knew of cash activity, because it filed CTRs on it.
• Failed to review available audits of its MSB customers to monitor risk of potential money laundering in those accounts.
• Failed to monitor its more than 200 identified high risk accounts, in spite of policy to do so.
• Lack of controls to monitor funds transfers for suspicious activity. There was over $1 Billion transferred over 21 months. One telecommunications company moved $100 million in two months, but the bank had no file documents to back up that level of phone card sales and telecom services.
• Failed to timely file suspicious activity reports. Because of inadequate anti-money laundering procedures, the bank failed to detect and report on a timely basis on at least 67 cases related to over $1.6 billion in suspicious activity.
  

• The bank issued $130 million in cashier's checks in eight months of 2002, without adequate anti-money laundering procedures and controls. The bank is located in both a High Intensity Drug Trafficking Area (HIDTA) and a High Risk Money Laundering and Related Financial Crimes Area (HIFCA).
• The bank failed to have a customer due diligence program to identify expected or reasonable customer activity.
• The bank failed to use its large currency transaction log to identify structuring over multiple-day periods.
• The bank incorrectly exempted two MSBs for at least 18 months. This resulting in late filing of at least 674 CTRs totaling over $35 million in transactions.
• The bank's independent review of its BSA program was not adequate. Two outside firms failed to identify the bank's monitoring weaknesses.
• The scope of the independent BSA review was inadequate, given the high volume of funds transfers to "Jurisdictions of Primary Concern" for money laundering, and the large volume of monetary instrument transactions at the bank.
• The bank failed at least 12 times to make timely SAR filings.
  • Customer operating sportswear business structured nearly $10 million in cash transactions from April 1999 - November 2002.
  • Another customer routinely made cash deposits of $9,900 up to four times a day, with no apparent business purpose.
  • Other customers made large currency transactions of from $300K to $600K per month, some apparently structured, with no apparent legitimate reason.
• The bank filed SARs that omitted significant relevant information.
  • In one case, the bank failed to include pre-1999 activity involving wires to Pakistan, India, and United Arab Emirates, understating overall dollar volume by $22 million.
  • In another, the bank omitted information on daily structuring activity in other customer accounts.
• Former bank president structured $419,000 in bank transactions on behalf of his son's business and $122,000 on behalf of a former bank director.

• Deficient documentation of customer information to adequately assess risk for money laundering.
• Failure to link customer accounts with common ownership to facilitate detection of suspicious activity.
• Failure to adequately review documentation for high-risk foreign accounts, such as non-bank financial institutions in Latin America.
• Lack of adequate systems and controls to monitor wire transfers for money laundering or other suspicious activity.
  181,000 wires in a year, totaling $35.4 Billion, with originators or beneficiaries with money-laundering characteristics.
  Failure to follow up on alerts from inadequate automated monitoring system.
• Failure to have adequate controls and monitoring procedures over activity in accounts of its own subsidiary, DBLA.
• Independent testing program was inadequate.
• Failure to adequately staff its compliance function with persons responsible for monitoring day-to-day compliance with BSA.
• Failure to make timely SAR filings, and failure to monitor on-going activity in accounts it had filed SARs on.
• Filing of incomplete or inaccurate SARs.

• Failed to file more than 200 CTRs prepared by Bank staff.
• Failed to file several staff-prepared SARs.
• Failed to notify the Bank's management of his failure to make the filings.
• Led management and "a review firm" to believe that the filings had been made.

• Failure to file timely registration as MSB with FinCEN.
• Failure to have written anti-money laundering program until required by IRS.
• Program created in 2004 was inadequate.
• Deliberate policy-based structuring of transactions to evade CTR requirements.

• Lack of adequate policies, procedures and controls for detection and reporting of suspicious transactions.
• Failure to describe responsibility for detecting, evaluating and reporting of suspicious activity.
• Failure to obtain enough information on customers, especially those in cash-intensive businesses.
• Patchwork, undocumented process for monitoring transaction activity.
• Inadequate searches of records in response to section 314(a) requests.
• Failure to make timely SAR filings, and failure to include adequate narrative information in filed SARs.

• Failure to establish and implement an anti-money laundering program as required by regulations.
  • Check cashing without controls designed to ensure compliance with BSA.
  • Failure to conduct independent testing of its AML program.
  • Failure to designate an individual responsible for day-to-day compliance with BSA.
  • Failure to train personnel to ensure compliance with BSA.
• Reckless disregard toward AML requirements of BSA led to failure to file CTRs.
  • IRS reminded Frosty twice prior to 2003 of its duty to file CTRs for single and multiple transactions.
  • After those warnings, Frosty continued to totally disregard the CTR requirements.
  • Failed to file 68 CTRs for 25 customers (total of over $1 million in cash) for single-check transactions.
  • Failed to file 12 CTRs on multiple transactions on same day, for eight customers.

• Lack of adequate policies, procedures and controls for compliance with BSA and manage money-laundering risk.
• Lack of adequate policies, procedures and controls for detection and reporting of suspicious transactions.
• Failure to ensure review of subpoenaed accounts for suspicious activity.
• Failure to have adequate systems to monitor wire transfers for suspicious activity.
• Failure to have systems for detection and reporting of multi-day cash structuring.
• A branch of the bank catered to high income/net worth individuals, without effective customer due diligence or transaction controls and monitoring.
• Employees were able to initiate large dollar wire transfers without oversight.
• Failure to detect/report suspicious activity by foreign unlicensed MSBs.
• Lack of risk analysis on high-risk clients.
• Lack of oversight for pouch activity deposits
• Deficient program for independent testing of BSA program, and failure of audit and management to follow up on significant identified deficiencies.
• Failure of the bank's designated BSA compliance officer to monitor and coordinate compliance on an enterprise-wide basis.
• Inadequate job-specific training to ensure BSA compliance.
• Failure to make timely SAR filings, which impaired the usefulness of those SARs that were filed late. More than 360 SARs were delinquent, covering over $189 in suspicious transactions.

• Failure to fully comply with C&D Order dated 4/12/2005.
• Failure to adequately amend its AML program to ensure compliance with BSA laws and regulations and other requirements in the C&D Order.
• Failure to timely comply with a requirement of the C&D Order calling for an appropriate and effective written compliance management program.

• Failure to follow its (the bank's) policies and procedures for ensuring compliance with the Bank Secrecy Act.
• lacking adequate systems and controls to comply with the Bank Secrecy Act.
• Failure to make timely SAR filings.

• Accounts at the Casino operated by agents for principals unrelated to the Tribe or the business.
• Principals and agents who managed those accounts from remote locations, using "subagents" at the business.
• Failure of the Casino to adopt a written program for BSA compliance.
• Failure to adopt internal controls designed to manage money-laundering risk and comply with BSA.
• Disregard of regulatory requirement for detection and reporting of suspicious activity.
• Failure to monitor for and report suspicious activity of persons identified as suspected money launderers and racketeers.
• Failure of independent audits to test compliance with requirements to file SARs, internal controls, and other requirements for compliance with BSA.
• Failure to provide BSA training to employees.
• Failure to designate an individual responsible for compliance with BSA or SAR filing requirements (other than filing CTRs).
• Failure to obtain and verify required identification information from account principals, or to ensure that agents had done so.
• Failure to use installed automated system to identify suspicious transactions.
• Failure to maintain complete and accurate records on funds transfers and other transactions.
• Failure to file SARs in spite of false ID information, sham corporations and other schemes to disguise the true identity of account principals.
• Failure to detect and file SARs on transactions involving large sums with no apparent business or lawful purpose.
• Failure to file CTRs, including one on $300,000 in cash deposited into Casino accounts at one time.
• Deliberate structuring of currency transactions of the Casino with banks to avoid CTR filings.
• Failure of the Tonkawa Tribe, through its Tribal Gaming Commission, to ensure Casino compliance with BSA and other requirements.

• Inadequate internal controls for ensuring compliance with the BSA and implementing regulations, especially those requiring SARs.
• Failure to detect and report suspicious journal transactions and wire transfers in one of Oppenheimer's foreign offices and a Florida office.
• Failure to aggregate wire transfers by customer, account, office or destination to see a true picture of total money movements.
• Failure to review accounts with post office addresses, including a large number of apparently unrelated persons showing the same home or business address (post office boxes or "care of" addresses in Florida.
• Failure to provide for independent testing of BSA compliance, and permitting Internal Audit to play a supervisory role in reporting suspicious activity.
• Failure to adequately staff for coordination and monitoring of BSA compliance. One officer and one analyst, both with other duties, were assigned to this role, when Oppenheimer had 1,600 registered representatives at over 100 branch offices serving 360,000 customers.
• Failure to have a BSA compliance training program tailored to job responsibilities.
• Failure to timely file SARs involving several million dollars in transactions in 2003.
• Filing incomplete SARs involving a foreign branch.

• Lack of adequate documentation to assess the potential for money laundering and risk rate financial institutions with correspondent relationships with the Center.
• Failure to document that ABN AMRO ever conducted adequate due diligence on correspondent financial institution clients of the Center.
• Failure to adequately monitor funds transfers processed by the Center for potential suspicious activity. Relied on one employees and manual monitoring under 2002. An automated system installed in 2002 was inadequate because it lacked data needed to evaluate the activity it was reviewing.
• Failure to incorporate available information on "shell companies" into the monitoring system. Some of these shell companies disguised the identity of Russian criminals.
• Failure to add to the monitoring system information on institutions included in SARs filed, or information on correspondent accounts closed, by ABN AMRO. One institution in a former Soviet Union Republic was reported in a SAR in January 2002, and ABN AMRO closed all correspondent accounts of that institution in July 2002. The barred institution opened accounts with institutions holding correspondent accounts through the Center, and the Center processed more than $100 million in transfers involving the institution via those correspondents without detecting the suspicious activity.
• Failure to investigate alerts from its automated monitoring system concerning transactions appearing to be suspicious.
• Failure to adequately staff the compliance function at the New York ABN AMRO branch to coordinate and monitor BSA compliance.
• Failure to adequately train staff in BSA compliance and in detection and reporting of suspicious activity.
• Failure to file, and delinquent filing of, SARs; filing of incomplete or inaccurate SARs.

• Permitting certain customers to mask the true beneficiary of deposit accounts and loans at the branch
• Failure to conduct adequate due diligence on the source of funds for new account or the purpose of loans.
• Failure to monitor the same accounts for suspicious activity and to file SARs in a timely manner.
• Making false, misleading and inaccurate statements to examiners about knowledge of nominee relationships between customers.

• Failure to implement adequate system of internal controls to comply with the BSA and manage the risks of money laundering and terrorist financing in its funds transfer operation.
• Limiting its focus of controls to transactions of its own customers, ignoring transactions for which it was merely an intermediary.
• Failure to include adequate procedures to incorporate identifying and other information on originators and beneficiaries in an in-house developed automated monitoring system.
• Failure to obtain adequate information on the potentially suspicious nature of funds transfers cleared by Arab Bank, including information on accounts frozen or monitored by regulatory and law enforcement authorities.
• Failure to use publicly-available information from reliable sources that would have identified funds transfer parties as deserving of extra monitoring for suspicious activity.
• Failure to adequately pursue anomalies identified in manual reviews. Acceptance of "we know this customer" from other Arab Bank Group members.
• Failure to implement adequate procedures for independent testing.
• Failure to file, and delinquent filing of, SARs.

• Filed CTRs with multiple errors and omissions of required information.
• Failed to identify the method used to verify an individual's identity;
• Failed to include all required information; and
• Failed to ensure the accuracy of the information that was included on CTRs.

• Failure to comply with BSA compliance program requirements for internal controls and an independent audit function.
• Failure to apply required enhanced due diligence policies, procedures, and controls to detect and report money laundering through private banking accounts of non-U.S. persons, and to detect and report transactions deriving from foreign corruption and involving private banking accounts of politically-exposed persons.
• Failure to make timely SAR filings.

• Inadequate board and management oversight of AML program.
• The bank's fragmented program lacked communication of suspicious activity information to those responsible for filing SARs.
• Inadequate internal controls and procedures to integrate information from numerous bank units to enable compliance with BSA and Section 314(a) search requirements.
  Monetary instrument sales information was not readily searchable.
  Legal Department had no system to alert BSA compliance personnel to subpoenas and information requests from law enforcement.
  Legal also failed to notify BSA or Security personnel of suspicious activity information learned through litigation activity.
• Failure to include in policies and procedures information about identification of suspicious activity or reportable events, or procedures to be followed when such and event was identified.
• Inadequate reporting to management.
• Failure to provide bank-wide training on detecting and reporting fraud and other suspicious activity. Some employees believed that only those activities resulting in a loss to the bank needed to be reported.
• Failure to implement adequate procedures for independent testing.
• Failure to file, and delinquent filing of, SARs. Several specific instances are described, including:
  In spite of employee comments that certain accounts were being used to further a Ponzi scheme, no SAR was filed until two years later.
  When AmSouth employees noted that the CFO of a corporate customer was making highly unusual transactions (he embezzled several million dollars), no SAR was filed because AmSouth suffered no loss.
  When a municipal official contacted AmSouth about another municipal official's suspected misappropriation of $450,000, AmSouth failed to file a SAR once it learned the suspect had died.
  AmSouth was subpoenaed seeking information on a depositor who ran a multi-million dollar fraudulent trading operation for five years. After the individual pleaded guilty, AmSouth closed his accounts, but never filed a SAR.

• Internal controls that were inadequate to ensure ongoing compliance with the BSA across business lines. They were not designed for the high-risk customers, products, services and international reach of the bank's business.
• Risk matrices used in some of Riggs' divisions contained similar criteria (not tailored to line of business on a risk-graded basis)
• The bank's customer due diligence program was not implemented in all areas consistently. The bank consequently failed to identify a large number of accounts associated with two foreign governments.
• Enhanced due diligence was inadequate in some high-risk areas.
  • Pay on ID wire transfers
  • Dealings with check cashers and money remitters
  • International private banking
  • Embassy banking
  • Banking with politically exposed persons and non-resident aliens
• Controls inadequate to identify suspicious transactions or to ensure timely filing of complete SARs.
• Failure to ensure that subpoenas and other government requests were referred for investigation potential suspicious activity.
• Failure to effectively manage its largest banking relationship, which involved a foreign government's accounts and politically exposed persons, and companies owned by those persons, in spite of warnings.
• Failure to have effective independent testing of the bank's BSA compliance.
  • Internal audit could not verify the effectiveness or timeliness of management's corrective actions for identified deficiencies.
  • Scope of audit omitted areas of money laundering vulnerabilities, BSA compliance or SAR process.
• BSA management was ineffective in day-to-day oversight, development and application of measures for compliance.
• Inadequate training on monitoring and detecting suspicious activity.
• Failure to make timely filing of 33 SARs covering $98 million in suspicious transactions.
  • Subpoenas and other matters weren't referred for investigation, delaying some SAR filings two or three years.
  • Failure to detect regular structuring of cash deposits and money order purchases; when SARs were finally filed, they were deficient.
• Failure to detect and report suspicious cash, monetary instrument and wire activity by the governments of two foreign countries, their politically-exposed persons, and their companies.
  • In one case, the bank's relationship manager had signature authority on two accounts within the relationship.
  • This manager was inadequately supervised by the bank.
  • The manager engaged in suspicious transactions himself, including the alteration of a check, and over $1 million in wire transfers into the manager's private investment corporation account at another bank.
• Filing of CTRs on transactions of two markets under incorrect names, involving 142 CTRs covering $7.3 dollars.
• Filing of CTRs on accounts of a business owned by a politically exposed person with an incorrect line of business, including transactions totaling $11.5 million.