Regulatory Bank Exam: Anti-Money Laundering (AML)/Bank Secrecy Act (BSA) Compliance Program Checklist

Assemble Your Compliance Team

Your bank’s compliance officer should begin by bringing together the compliance team at least 90 days before the regulatory bank exam. This initial meeting should discuss what the next 90 days will look like to give your team enough time to prepare for federal examiners.

Review Previous Bank Exams & Reports

The first thing your compliance team should do is review internal documentation and records. The goal is to identify any cracks in your policies and procedures that may have developed since the last regulatory bank exam.

• Review compliance manuals to make sure they reflect any regulatory changes since the last bank exam.
• Verify that all policies and procedures are documented properly.
• Gather the most recent AML/BSA reviews and prior regulatory reports and ensure all findings and recommendations have been addressed. 

Review Customer Identification & Customer Due Diligence Programs

CIP and CDD programs are designed to prevent or identify suspicious behavior in your customers from an anti-money laundering perspective. A bank examiner will want to review that customer identification and verification processes are compliant with KYC (know your customer) regulations.

1. Evaluate Policy & Procedures

• Ensure CIP and CDD policies and procedures are up-to-date and aligned with current regulatory requirements. 
• Review any recent changes in AML laws and see if your policies reflect these updates.

2. Verify Customer Information Collection

• Check that all required customer information is being collected accurately during account opening. 
• Check the identification documents being collected, and ensure you are maintaining up-to-date records.

3. Risk Assessment Process 

• Review the risk assessment criteria used to classify customers. 
• Verify that risk levels (e.g., low, medium, high) are appropriately assigned based on the customer’s profile and transaction history. 
• Make sure all transaction records are complete and accessible.

4. Ongoing Monitoring 

• Use robust systems for ongoing monitoring of customer transactions. This includes identifying and reporting suspicious activities in line with regulatory guidelines.

5. Staff Training

• Check that all relevant staff members are adequately trained on CIP and CDD processes.

Assess Your Review Monitoring & Reporting Systems

Knowing that your staff follows AML regulations is one thing. But can your community bank’s monitoring and reporting systems determine if illegal activity is taking place through your bank? 

Review these systems, both automated and with reporting by staffers, to determine if they are running properly.

1. System Effectiveness

• Check if automated systems for transaction monitoring and reporting are in place and functioning correctly.
• Are monitoring systems integrated with other banking systems to capture all relevant data?

2. Transaction Monitoring

• Confirm that the system provides real-time monitoring of transactions.
• Ascertain that the system effectively detects and flags suspicious activities.
• Check if the system generates alerts for unusual or high-risk activities and transactions.
• Are monetary instrument purchase logs maintained and completed accurately and on a timely basis? 
• Confirm that the Bank has established wire transfer recordkeeping procedures and has maintained appropriate information. 

3. Data Accuracy & Integrity

• Is all relevant data being accurately collected and fed into the monitoring system?
• Verify that data integrity checks are in place to prevent and detect data corruption or tampering.

4. Suspicious Activity Reporting (SAR)

• Identify a clear process for filing SARs in compliance with regulatory requirements.
• Check that SARs are being filed within the required time frames.
• Assess the completeness and accuracy of SARs for meeting regulatory standards.

5. Currency Transaction Reporting (CTR)

• Identify a clear process for filing CTRs in compliance with regulatory requirements.
• Check that SARs are being file within the required time frames.
• Assess the completeness and accuracy of SARs for meeting regulatory standards.

6. Regular Audits & Reviews

• Does your bank conduct regular internal audits of the monitoring and reporting systems?
• Schedule periodic external reviews to provide an objective assessment of the systems.
• Do managers address issues and findings from audits and reports promptly?

7. Staff Training & Awareness

• Verify that staff involved in monitoring and reporting are regularly trained as new information becomes available.
• Conduct awareness campaigns to keep staff updated on the importance of compliance and reporting requirements.

8. Reporting Mechanisms

• Check if regular reports are provided to senior management to keep them informed about compliance status and issues.

8. System Updates & Maintenance

• Confirm that the monitoring and reporting systems are regularly updated to reflect changes in regulations and business operations.

Test Internal Controls

Do you know if your internal controls work as expected? Preparing for a regulatory bank exam is the perfect time to test the system when you need to identify potential areas of risk.

After you review documentation and processes, it’s wise to test how your staff and systems respond to a test in real-time.

1. Plan the Testing Process

• Establish clear objectives for testing AML internal controls.
• Determine the scope, including the specific controls and processes to be tested.
• Create a detailed plan outlining the testing procedures, timeline, and resources required.

2. Test Transaction Monitoring Systems

• Certify that the transaction monitoring system is functioning correctly.
• Does your monitoring system generate alerts for suspicious activities according to defined thresholds and rules?
• Review the process for investigating and resolving alerts.

3. Verify Suspicious Activity Reporting (SAR)

• Select a sample of SARs filed within a specific period.
• Are SARs filed within the required time frames?
• Assess the completeness and accuracy of SARs.

4. Conduct Record-Keeping Checks

• Corroborate that customer identification and transaction records are retained for the required periods.
• Ensure records are easily accessible for review and audit.

5. Test Policy & Procedure Implementation

• Are AML procedures being followed correctly by staff?
• Conduct walkthroughs of key AML processes to identify any gaps or weaknesses.

6. Reporting Mechanism Checks

• Demonstrate that employees can report suspicious activities and compliance issues confidentially.
• Are managers reviewing and acting upon reports in a timely manner?

7. Continuous Improvement

• Verify there is a feedback loop to incorporate findings from testing into the AML program.
• Regularly update AML policies and procedures based on testing results and regulatory changes.

Assess & Establish Risk Appetite

You need to understand your customers to develop customer risk profiles. How much risk is your bank willing to take with customers? How do you leverage risk profiles to achieve your bank’s growth objectives? A risk profile and position isn’t just for your board of directors. It filters down to everyday business with your customers.

1. Assess Current Risk Position

• Compile a comprehensive inventory of current risks faced by the bank.
• Evaluate the current risk exposure levels in relation to the bank’s objectives. Specifically, determine the adequacy of procedures for determining whether a commercial customer presents more than a minimal risk of engaging in an internet gambling business.
• Identify gaps between current risk levels and the desired risk appetite.

2. Align Risk Appetite With Strategy

• Align the risk appetite with your bank’s strategic goals and business plan.
• Develop key performance indicators (KPIs) to measure the alignment of risk appetite with strategic objectives.

3. Risk Identification & Measurement

• Continuously identify potential risks that could impact the bank, including risky customers.
• Use appropriate tools and methodologies to measure and quantify risks.
• Are BSA obligations being met if services are provided to marijuana-related businesses? 

4. Monitor & Review

• Continuously monitor risk levels against the established risk appetite. How is your community bank doing? Did any failures occur with potentially risky customers?
• Conduct regular reviews and updates of the risk appetite statement and risk limits. Make sure your risk appetite is up-to-date ahead of a bank regulatory exam.
• Develop a robust risk reporting framework to keep senior management and the board informed.

5. Adjust & Adapt

• Be prepared to adjust the risk appetite based on changes in the internal and external environment.

Evaluate Anti-Money Laundering Software

Does your anti-money laundering software meet your bank’s requirements and AML/BSA requirements? A bank regulatory exam will ask you about what vendors you use and how well they work.

1. Software Inventory & Documentation

• Compile a comprehensive list of all software systems used for risk data and due diligence checks.
• Verify that all system documentation is up-to-date, including user manuals, system architecture, and process workflows.

2. Compliance & Regulatory Requirements

• Demonstrate that the software complies with relevant regulatory standards (e.g., AML, KYC, etc).
• Does your software’s functionality align with the bank’s internal policies and procedures?

3. Data Integrity & Accuracy

• Check the accuracy and completeness of the data being processed by the software.
• Do data validation mechanisms prevent errors?
• Are data sources reliable and trusted?

4. Functionality & Performance

• Test key features and functionalities of the software to see that they work as intended.
• Can the software handle increasing volumes of data as the bank grows?

5. Integration With Other Systems

• Software should integrate seamlessly with other banking systems and databases.
• Demonstrate that data flows correctly between systems without loss or corruption.

6. User Training & Support

• Review the training programs provided to users for operating the software.
• Software suppliers should provide adequate support for users, including helpdesk and technical support services.

7. Vendor Management

• Assess the vendor’s reputation, reliability, and support services.
• See that service level agreements (SLAs) are in place and being met.
• Verify that the software is regularly updated and patched by the vendor.

8. Backup & Recovery

• Review that regular backups of the system and data are performed.
• Test the disaster recovery plan so that your data is safe in case of a failure.

Create a Culture of Compliance

Management must lead the way when it comes to creating a culture of compliance. It’s not enough to talk about compliance. Your community bank should be proactive by giving every employee the tools they need to keep your bank in compliance with AML/BSA regulations. 

Evaluate your culture of compliance with these benchmarks.

1. Employee Training

• Schedule compliance training sessions for all staff.
• All employees must understand their roles in maintaining compliance.

2. Management Briefings

• Brief senior management on the upcoming exam and areas of focus.
• Update management when needed to make them aware of any changes in regulatory requirements.

3. Policy & Procedure Review

• Review and update all compliance-related policies and procedures.
• Ensure policies are easily accessible to all employees.

4. Compliance Program Effectiveness

• Evaluate the overall effectiveness of the compliance program.
• Implement any necessary improvements.

Consider Independent Testing & Auditing 

The Whitlock Co. can help you prepare your community bank for a regulatory exam by performing independent tests and audits. Our team will help your staff get ready for the bank examiner’s questions and processes. We are an independent auditor and can give you third-party insights you might not think of when assessing your AML/BSA regulatory compliance.

Contact The Whitlock Co. to request a consultation today.