Federal Deposit Insurance Corporation
Office of Audits
Office of Inspector General
Washington, D.C. 20434

DATE: September 5, 2003

MEMORANDUM TO: Michael J. Zamorski, Director, Division of Supervision and Consumer Protection

FROM: Russell A. Rau [Electronically produced version; original signed by Russell Rau], Assistant Inspector General for Audits

SUBJECT: The FDIC's Implementation of the USA PATRIOT Act(Audit Report Number 03-037)

This report presents the results of the Office of Inspector General’s (OIG) audit of the Federal Deposit Insurance Corporation's (FDIC) implementation of the United and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001, Public Law 107-56 (USA PATRIOT Act, hereafter referred to as the PATRIOT Act). The overall objective of this audit was to determine whether the FDIC has developed and implemented adequate procedures to examine financial institutions’ compliance with the PATRIOT Act. To accomplish our objective, we reviewed actions that the FDIC’s Division of Supervision and Consumer Protection (DSC) has taken to implement the Act. (Note: The FDIC’s DSC, in conjunction with other federal and state regulatory agencies, examines financial institutions to ensure they are conducting business in compliance with consumer protection rules and in a way that minimizes risk to their customers and to the deposit insurance funds. There are five categories of examinations: Safety and Soundness, Community Reinvestment Act, Compliance, Information Technology, and Trust.)

Appendix I of this report discusses our objective, scope, and methodology in more detail. Appendix V and Appendix VI provide the acronyms and a glossary of terms used in this report, respectively.

BACKGROUND

Under the PATRIOT Act, the Secretary of the Treasury (Treasury Department) continues efforts to combat the corruption of United States financial institutions for money laundering purposes. (Note: For reporting purposes, we will refer to the Secretary of the Treasury as the “Treasury Department” rather than “Secretary” or “Treasury.” Financial institutions under the Bank Secrecy Act of 1970 and the PATRIOT Act include federally insured institutions such as banks, thrifts, and credit unions; and other financial service providers such as brokers or dealers in securities or commodities; issuers, redeemers, or cashiers of travelers’ checks or money orders; travel agencies and loan or finance companies; insurance companies; pawnbrokers; telegraph companies; and the United States Postal Service.) According to federal law, money laundering is the flow of cash or other valuables derived from, or intended to facilitate, the commission of a criminal offense. (Note: More specifically, money laundering is the process by which criminals or criminal organizations seek to disguise the illicit nature of their proceeds by introducing them into the stream of legitimate commerce and finance.) The PATRIOT Act broadens authority and required regulations to combat money laundering that were already established under the Bank Secrecy Act (BSA) of 1970, codified to 31 U.S.C. Section 5311 et seq. by specifically amending that Act. (Note: The Bank Secrecy Act of 1970, also known as the Currency and Foreign Transactions Reporting Act, requires financial institutions to maintain appropriate records and file certain reports that are used in criminal, tax, or regulatory investigations or proceedings.) The BSA’s implementing regulation, 31 Code of Federal Regulations (C.F.R.) 103, is used to aid law enforcement agencies in the investigation of suspected criminal activity, ranging from income tax evasion to money laundering by organized crime. Congress enacted the BSA to prevent banks and other financial service providers from being used as intermediaries for, or to hide the transfer or deposit of money derived from, criminal activity. (Note: Bank Secrecy Act/Anti-Money Laundering, Comptroller’s Handbook, dated September 2000.)

The BSA consists of two parts—Title I, Financial Recordkeeping and Title II, Reports of Currency and Foreign Transactions.

• Title I authorizes the Treasury Department to issue regulations requiring insured financial institutions to maintain certain records related to financial transactions.
  
  
• Title II directs the Treasury Department to prescribe regulations governing the reporting of certain transactions by and through financial institutions in excess of $10,000 into, out of, and within the United States. A financial institution must file a Currency Transaction Report (CTR) with the Internal Revenue Service for each cash transaction over $10,000 or multiple cash transactions by an individual in one business day aggregating over $10,000. (Note: In addition, as noted in the OIG’s report entitled Examination Assessment of Bank Secrecy Act Compliance, Audit Report Number 01-013, dated March 30, 2001, BSA requires financial institutions to file Suspicious Activity Reports (SARs) with the Treasury Department when suspected money-laundering activity or BSA violations occur.)

PATRIOT Act Expands BSA Requirements

The PATRIOT Act expands the Treasury Department authority to regulate the activities of United States financial institutions, particularly their relations with individuals and entities with foreign ties.

More specifically, the PATRIOT Act:

• Expands requirements under the BSA, including requirements related to due diligence for certain types of bank accounts, including correspondent and concentration accounts; requirements related to verification of customer identification; and anti-money laundering procedures. (Note: For the PATRIOT Act, due diligence includes policies, procedures, and controls that are reasonably designed to detect and report instances of money laundering. A correspondent account is an account established by a covered financial institution to receive deposits from, or make payments or other disbursements on behalf of, a foreign financial institution. A concentration account is any internal account established by the bank to facilitate the processing and settlement of multiple or individual customer transactions with the bank.)
  
  
• Expands the United States anti-money laundering umbrella to industries not previously subject to this type of regulation, such as other service providers that are not insured by the FDIC, including redeemers and sellers of money orders and travelers’ checks, check cashers, and currency retail exchanges. (Note: Before the PATRIOT Act, only insured institutions were required, by regulation, to file reports on suspicious activities. The PATRIOT Act amended the BSA to require all financial institutions, as defined by the BSA, to have a formal anti-money laundering program.)
  
  
• Marks the first time the United States has taken its money laundering regulations offshore in order to monitor foreign branches of United States banks and foreign institutions operating in the United States.
  
  
• Expands criminal sanctions already included in the BSA by increasing civil and criminal penalties for money laundering. (Note: Civil and criminal money penalties may be an amount equal to not less than 2 times the amount of the involved transaction, but not more than $1 million, on any financial institution or agency that violates provisions of Title 31, U.S. Code, that (1) govern due diligence requirements for United States private banking and correspondent bank accounts involving foreign persons or (2) prohibit correspondent accounts with foreign “shell” banks.)

These provisions are intended to facilitate the prevention, detection, and prosecution of international money laundering and the financing of terrorism. (Note: Terrorism includes acts that violate criminal laws of the United States, attempt to coerce civilians or the government, or involve some effect upon the government by mass destruction, assassination, or kidnapping.)

Title III of the PATRIOT Act

The PATRIOT Act has 10 titles that relate to the prevention of money laundering and financing of terrorism. The scope of our audit covered 1 of those 10 titles—Title III, which is entitled International Money Laundering Abatement and Anti-terrorist Financing Act of 2001. Title III consists of 46 sections, which include provisions related to (1) international counter-money laundering and related measures, (2) BSA amendments and related improvements that supplement the United States’ authority to detect money laundering provided under the BSA, and (3) currency crimes and protection. In addition, Title III provisions include requirements related to special due diligence, correspondent accounts, concentration accounts, verification of customer identification, and information sharing. Further, Title III places considerable responsibilities on insured depository institutions to monitor foreign entities and individuals and cooperate with law enforcement officials in a timely manner. Under Title III, the FDIC is responsible for monitoring compliance with the PATRIOT Act by the financial institutions that it supervises. (Note: The FDIC is the primary federal regulator of state-chartered institutions that are not members of the Federal Reserve System (FRS). According to the FDIC’s Letter to Stakeholders, 2nd Quarter 2003, the number of state-chartered institutions that are not members of the Federal Reserve System totaled 5,338.)

The Treasury Department Has the Lead Role in Implementation

The Treasury Department is assigned the vast majority of the tasks associated with implementing the PATRIOT Act and, accordingly, has the lead role in implementing the Act. The PATRIOT Act is implemented through the Treasury Department’s rulemaking process. More specifically, the Treasury Department, through its Financial Crimes Enforcement Network (FinCEN), issues proposed, interim, and final rules to implement the Act. (Note: The Treasury Department’s FinCEN, established in 1990, oversees and implements policies to prevent and detect money laundering. In addition, the administration of the BSA, which authorizes the Treasury Department to require financial institutions to file certain reports and keep certain records of financial transactions, (e.g., suspicious activity reports, currency transaction reports, reports of cross-border currency transportation, and reports relating to foreign bank and securities accounts), is the primary regulatory activity of FinCEN.) Alternatively, the Treasury Department, through FinCEN, may issue joint rules with the:

• Office of the Comptroller of the Currency (OCC) (Note: OCC regulates national banks and federally chartered branches and agencies of foreign banks.),
• Office of Thrift Supervision (OTS) (Note: OTS regulates savings and loan or savings associations and thrift holding companies.),
• Board of Governors of the Federal Reserve System (FRB) (Note: The FRB regulates state-chartered banks that are members of the FRS. The FDIC and the FRB coordinate guidance for the examination of state-chartered financial institutions with the Conference of State Bank Supervisors (CSBS).),
• FDIC,
• National Credit Union Administration (NCUA) (Note: NCUA charters and supervises federal credit unions.),
• Commodity Futures Trading Commission (CFTC) (Note: CFTC regulates the commodity futures and option markets in the United States. A commodity futures contract is an agreement to buy or sell a specific commodity at a specific price in the future. An option on a futures contract gives the buyer the right to convert the option into a futures contract.), and
• Securities and Exchange Commission (SEC). (Note: SEC regulates the securities industry, including stock exchanges, broker-dealers, investment advisors, mutual funds, and public utility holding companies.)

DSC Monitors Institutions’ Compliance

The FDIC’s authority to examine the financial institutions that it supervises for compliance with the PATRIOT Act, specifically, Title III provisions, derives from statutory authority and Treasury Department regulations. Section 8 of the Federal Deposit Insurance Act (FDI Act), codified to 12 U.S.C. 1818, requires the FDIC to:

• prescribe regulations requiring regulated institutions to establish and maintain procedures reasonably designed to ensure and monitor compliance with the BSA and
  
  
• review such procedures during the course of FDIC examinations.

Additionally, although overall authority for BSA enforcement and compliance remains with the Treasury Department, its regulations delegate authority to bank regulatory agencies, including the FDIC, to examine banks for compliance.

BSA violations are subject to supervisory enforcement actions such as Cease and Desist orders as well as civil monetary penalties.(Note: A Cease and Desist order is a formal enforcement action issued by financial institution regulators to a bank or affiliated party to stop an unsafe or unsound practice or violation. The order may be terminated when the bank’s condition has improved and the action is no longer needed or the bank has materially complied with the terms of the order.) For instance, the FDI Act authorizes the regulatory agencies to issue Cease and Desist orders. Those orders can be issued if a regulated institution fails to establish and maintain adequate procedures related to BSA or to correct problems with the procedures after an agency has notified the institution that problems exist. In addition, regulatory agencies may impose civil money penalties for violations of Cease and Desist orders.

Section 326.8(b) of the FDIC’s rules and regulations, codified to 12 C.F.R. 326.8, requires FDIC-supervised institutions to develop and administer a program to ensure compliance with the BSA and its implementing regulation 31 C.F.R 103. Financial institutions’ boards of directors must approve the program and document that approval in writing. At a minimum, financial institutions must implement a program that includes: (1) a system of internal controls, (2) independent testing for compliance with the BSA and its implementing regulation 31 C.F.R. 103, (3) designation of the individual(s) responsible for coordinating and monitoring compliance with the BSA, and (4) training in BSA requirements for appropriate personnel.

Within the FDIC, examination authority has been further delegated to the DSC. According to the FDIC Case Managers Procedures Manual, the FDIC should incorporate a BSA review at each onsite examination, generally interpreted to mean each safety and soundness examination. In response to the BSA, the FDIC has developed comprehensive examination procedures to use during its safety and soundness examinations. (Note: DSC uses a risk-focused examination program designed to focus examination resources on areas that present the greatest risk to insured institutions. DSC examiners conduct a risk-scoping and pre-examination process to determine appropriate levels of risk to assign to each functional area, including BSA compliance. Based on that assessment, examiners determine the most appropriate examination plan for each financial institution.) Those procedures are included in a DSC examination module, dated February 2001, and are used to determine whether financial institutions properly implement BSA provisions and to independently identify instances of potential money laundering. During safety and soundness examinations, DSC examiners are required to determine whether a financial institution’s management has done the following:

• Established adequate policies and procedures in accordance with anti-money laundering laws and regulations.
  
  
• Developed a system to identify large currency deposits.
  
  
• Identified, investigated, and reported suspicious transactions.
  
  
• Assigned responsibilities for ongoing compliance with BSA and financial recordkeeping regulations to a qualified person.
  
  
• Established an adequate BSA training program for employees.
  
  
• Performed internal reviews and independent audits to identify potential deficiencies in the BSA program.

A bank's failure to comply with the BSA or a bank's involvement in money laundering can endanger its reputation, impact its capital and earnings, negatively reflect on the bank's management, and result in regulatory sanctions. Examinations that identify cases in which a bank has knowingly and willfully violated the BSA are referred, at the recommendation of the FDIC’s regional offices, directly to the Treasury Department and, in some instances, to a United States Attorney. In addition, to coordinate the investigation of possible criminal misconduct, DSC notifies the FDIC OIG of recommendations for financial institutions to file SARs or when DSC prepares a SAR.

To assist the DSC in its monitoring process, the FDIC issues regulations, Financial Institution Letters (FILs), and other guidance to financial institutions that it supervises; updates FDIC examination and training materials; and ensures that DSC examiners are adequately trained to monitor compliance with the PATRIOT Act. (Note: The FDIC uses FILs to correspond with financial institutions that it supervises. FILs may be issued for a variety of reasons, including notification of PATRIOT Act requirements and other issues of principal interest to those responsible for operating a bank or savings association.) In addition, the FDIC participates in interagency working groups that (1) coordinate with other regulatory agencies and (2) ensure consistency of examination procedures used to monitor compliance by state-chartered financial institutions.

RESULTS OF AUDIT

The FDIC’s existing BSA examination procedures either partially or fully cover six of the eight anti-money laundering subject areas required by Title III of the PATRIOT Act and do not address the remaining two areas included in Title III. (See Finding A—Bank Secrecy Act Examination Procedures Cover Some PATRIOT Act Requirements). With respect to those Title III provisions that require new or revised examination procedures, DSC has coordinated its efforts with other regulatory agencies and began drafting new or revised examination procedures in October 2002, as deemed necessary, to implement the provisions. DSC has continued its efforts to draft new or revised examination procedures with updates made to those procedures as recently as April 2003. However, DSC has not yet issued new or revised examination procedures because it either is waiting for the Treasury Department to issue final rules implementing Title III provisions or is coordinating the issuance of uniform procedures with an interagency steering committee. This delay in issuing procedures is particularly a concern where the Treasury Department issued final rules related to:

• the prohibition on U.S. correspondent accounts, actions to deter money laundering, and the improvement of information sharing (September 2002) and
  
  
• the verification of customer identification (May 2003).

At the time we completed our field work, DSC expected to issue new or revised interagency examination procedures no later than September 30, 2003, in accordance with a corporate performance objective described in Appendix I. (Note: DSC’s response to our draft report, included as Appendix VII, indicated that the interagency procedures will be delayed beyond September 30, 2003.) However, the lack of examination procedures to determine full compliance with Title III provisions limits assurance that DSC examiners are assessing institutions’ full compliance with the PATRIOT Act and that the institutions are taking steps to implement all Title III provisions that are intended to facilitate the highest level of prevention, detection, and prosecution of international money laundering and the financing of terrorism. (See Finding B—DSC’s Progress in Implementing New Examination Procedures).

FINDING A: BANK SECRECY ACT EXAMINATION PROCEDURES COVER SOME PATRIOT ACT REQUIREMENTS

Some of the Title III provisions included in the PATRIOT Act expand existing requirements under the BSA. Because DSC’s examinations include procedures to determine compliance with the BSA, financial institutions regulated by the FDIC are already monitored to determine compliance with PATRIOT Act provisions, to some degree. As outlined below, BSA examination procedures partially cover subject areas included in five Title III Sections—312, 313, 319, 325, and 326. In addition, existing BSA examination procedures cover all requirements of the subject area in Section 352 of Title III. Accordingly, DSC will continue to use existing BSA examination procedures, included in its Examination Documentation (ED) Modules, as a foundation for its new or revised examination procedures to determine compliance with the PATRIOT Act, Title III provisions.

• Section 312—Special Due Diligence—BSA examination procedures include steps to review a bank’s due diligence on private banking customers and internal correspondent banking relationships. The April 2003 draft revisions that DSC has made to its examination procedures based on PATRIOT Act provisions include steps for examiners to determine whether financial institutions implement due diligence policies, procedures, and controls. (Note: The FDIC began revising its examination procedures related to Title III provisions during October 2002, with most recent revisions made during April 2003. Those revisions have not yet been finalized and are being reviewed by and coordinated with the FDIC-FRS-CSBS Steering Committee For Risk-Focused Supervision Examination Procedures and Supporting Software. The FDIC’s participation on and results of the Steering Committee are discussed in detail in Finding B.)
  
  
• Sections 313 and 319—Prohibition on U.S. Correspondent Accounts—Existing BSA examination procedures include steps to evaluate the bank’s system to identify suspicious activity in foreign correspondent accounts. The April 2003 draft revisions to examination procedures based on PATRIOT Act provisions include steps for examiners to confirm that the financial institution has obtained required documentation on foreign correspondent accounts within 30 calendar days after the date the account is established. The documentation should verify that the foreign correspondent bank is not a foreign shell bank and that the U.S. correspondent account is not used to indirectly provide services to foreign shell banks. Documentation should also describe the bank’s procedures for closing or terminating foreign correspondent accounts, re-certifying required documentation, and responding to written requests from federal law enforcement officers.
  
  
• Section 325—Concentration Accounts—BSA examination procedures include steps to review a bank’s “special use” or “concentration” accounts. Those procedures include confirming that financial institutions assess the adequacy of internal controls that have been implemented to ensure the proper use of special use/concentration accounts and reviewing the nature of account activity for any suspicious or unusual activity. The April 2003 draft revisions to examination procedures include steps for examiners to confirm that bank policy prohibits (1) customers from directing the movement of funds through special use accounts and (2) bank employees from disclosing the existence of a special use account to customers.
  
  
• Section 326—Verification of Identification—BSA examination procedures include steps for reviewing bank account opening procedures and customer due diligence guidelines. The April 2003 draft revisions to examination procedures due to PATRIOT Act provisions include steps for examiners to confirm that the financial institution’s board adopts a written customer identification program for new accounts that includes (1) required customer identification information, (2) identification verification procedures, and (3) recordkeeping and retention procedures.
  
  
• Section 352—Anti-money Laundering Programs—BSA examination procedures include steps for examiners to determine whether financial institutions have adopted a written anti-money laundering program. The procedures include steps to determine whether the programs contain a system of internal controls, an independent testing for compliance, a designated qualified individual responsible for coordinating and monitoring day-to-day compliance, and training for appropriate personnel. As of April 2003, DSC had not drafted any revisions to its current examination procedures that relate to anti-money laundering programs. DSC officials stated that no revisions are necessary to comply with Title III provisions.

Further, in instances in which the Treasury Department has issued final rules implementing the Title III provisions—Sections 313, 314, 319, and 326—DSC has issued FILs informing the institutions that it supervises of the new requirements. DSC has not issued FILs for those sections for which the Treasury Department has not issued final rules.

Appendix II provides a comparison of the BSA and Title III provisions, illustrates in detail how existing BSA examination procedures cover some of Title III’s requirements, and provides a description of expanded coverage, such as amending the FDI Act.

FINDING B: DSC’S PROGRESS IN IMPLEMENTING NEW EXAMINATION PROCEDURES

DSC has not yet issued new or revised examination procedures to determine whether the financial institutions it supervises are complying with PATRIOT Act Title III provisions not fully covered by current BSA examination procedures. DSC has not done so even though the Treasury Department has issued final rulings for four such provisions. DSC has drafted new and revised examination procedures to implement Title III provisions. However, DSC is coordinating the issuance of the procedures with other regulatory agencies and an interagency steering committee. Thus, DSC does not have complete control over issuance of the interagency procedures. Until the procedures have been issued and fully implemented by examiners, DSC’s assurance is limited that the financial institutions that it supervises are in compliance with the PATRIOT Act Title III provisions, except for the one Title III section that is fully covered by current BSA examination procedures.

DSC initiated its process to issue new and/or revised examination procedures addressing Title III provisions during October 2002 and has continually made updates to those procedures. The issuance of those procedures depends heavily on DSC’s association and coordination with three external entities or groups:

• the Treasury Department;
  
  
• interagency working groups that have included representatives from the OCC, OTS, FRB, NCUA, CFTC, and SEC; (Note: Agencies are not always included in discussions for all PATRIOT Act sections. They may be involved only in discussions that affect institutions that they supervise or apply to them in general.) and
  
  
• the FDIC-FRS-CSBS Steering Committee For Risk-Focused Supervision Examination Procedures and Supporting Software, which is composed of representatives from the FDIC, FRB, and CSBS.

Treasury Department Progress Impacts the FDIC

The timeliness of DSC’s issuance of examination procedures related to implementing Title III provisions is dependent, in part, upon the Treasury Department, which is responsible for issuing rules (proposed, interim, and final) that provide guidance that financial institutions should use to implement Title III provisions. Those rules are published in the Federal Register. When published in the Federal Register, the rules provide specifics on the applicability of Title III provisions, institutions covered under the rules, the effective date of a rule, and an overview of comments received and considered before publication.

Title III of the PATRIOT Act consists of 46 sections. However, only 8 of those 46 sections relate to examination procedures. Of those eight sections, only seven require the FDIC to issue revised or new examination procedures to assess compliance with the Act. DSC’s procedures for BSA compliance already include steps that fully cover requirements for one of the eight sections—Section 352-Anti-Money Laundering Programs. Those procedures are used to determine whether financial institutions have implemented adequate controls related to an anti-money laundering program.

Of the seven Title III sections that require the FDIC to issue revised or new examination procedures, 5 sections—312, 313, 319, 325, and 326—require revisions to procedures already included in BSA examinations. The remaining two sections—311 and 314—are new requirements and, accordingly, require the FDIC to issue new examination procedures.

• Section 311—Special Measures for Financial Institutions. This section gives the Treasury Department authority to designate a foreign jurisdiction, institution, class of transactions, or type of account as a “primary money laundering concern” and to impose certain “special measures” with respect to such jurisdiction, institution, class of transactions, or type of account. Those five special measures include (1) recordkeeping and reporting of certain financial transactions, (2) information relating to beneficial ownership, (3) information relating to certain payable-through accounts, (4) information relating to certain correspondent accounts, and (5) prohibitions or conditions on opening or maintaining certain correspondent or payable-through accounts. DSC’s draft examination procedures include steps for examiners to confirm that the financial institutions have taken appropriate steps to comply with the special measures imposed by the Treasury Department on one or more classes of transactions that are found to be of primary money laundering concern.
  
  
• Section 314—Cooperative Efforts to Deter Money Laundering. (Note: Title III Section 314 is also referred to as Information Sharing.) This section requires the Treasury Department to issue regulations to encourage financial regulators and law enforcement officials to share information with financial institutions regarding persons reasonably suspected of money laundering activities. DSC’s draft examination procedures include steps for examiners to confirm whether financial institutions have programs to comply with Section 314(a) information requests, which include the following:
  
  
  • designation of an employee as the contact person responsible for handling Section 314(a) information requests,
    
    
  • procedures to ensure that all required records are searched, with positive hits reported to the Treasury Department’s FinCEN within designated timeframes, and
    
    
  • appropriate records to document search results.

Appendix III provides an analysis of the Title III sections that are applicable to the FDIC, the status of information provided to financial institutions that the FDIC supervises, and the status of DSC’s development or revision of examination procedures for those sections. Appendix IV provides an analysis of Title III sections applicable to the FDIC that do not require revision to existing or issuance of new examination procedures.

The Treasury Department has issued three final rules addressing four of the seven Title III sections that require DSC to take some type of action related to its examination procedures. In turn, DSC has issued FILs to institutions that inform them of PATRIOT Act requirements and the Treasury Department’s final rulings for those four sections. More specifically, DSC issued FILs related to Sections 313, 314, 319, and 326 of Title III. Although DSC has not issued FILs for the remaining three Title III sections that require action (Sections 311, 312, and 325), as previously discussed, it has taken steps towards revising examination procedures or developing new procedures related to those sections.

Interagency Working Groups and Steering Committee Also Play a Role in the FDIC’s Progress

DSC is coordinating its issuance of examination procedures with other regulatory agencies and an interagency steering committee. DSC has participated in external interagency working groups that have included the OCC, OTS, FRB, NCUA, CFTC, and SEC. Since December 2001, those groups have met periodically to discuss the scope, terms, and timing of rules and regulations related to Title III provisions. In addition, the FDIC is a member of the FDIC-FRS-CSBS Steering Committee For Risk-Focused Supervision Examination Procedures and Supporting Software (Steering Committee). According to DSC Transmittal Number 98-097, dated December 3, 1998, the purpose of that interagency committee is to coordinate efforts to maintain interagency consistency in examination procedures and oversee the ongoing enhancements to the supporting software. (Note: Software products currently associated with examination procedures include Examination Documentation (ED), General Examination System (GENESYS), and Automated Loan Examination Review Tool (ALERT). The Steering Committee also includes a Subgroup on Risk-Focused Examination Procedures responsible for soliciting recommendations from field examiners, updating the content of examination modules, and distributing the revised modules to the field.)

The interagency working groups and Steering Committee have played pivotal roles in identifying new procedures and revising already existing examination procedures related to the Title III provisions. DSC made the most recent revisions to the procedures during April 2003 and is collaborating with the Steering Committee before issuing the final examination procedures for implementation. DSC will not formally issue and incorporate those procedures into its examination process until they have been reviewed and approved by the Steering Committee.

Lack of Examination Guidance Limits Assurance That Certain PATRIOT Act Provisions Are Being Effectively Implemented

DSC has not issued or implemented examination procedures to ensure that financial institutions are complying with the requirements of four sections of Title III that the Treasury Department has finalized. Specifically, the Treasury Department issued final rules for three of these four sections in September 2002 as discussed below.

• Sections 313 and 319—Prohibition on U.S. Correspondent Accounts. The Treasury Department issued a final ruling on September 26, 2002, requiring that financial institutions take reasonable steps to ensure that they are not providing banking services directly or indirectly to foreign shell banks. As a result, the FDIC issued a FIL on December 11, 2002, informing institutions that it supervises of the new requirements for Sections 313 and 319. As discussed earlier, the intent of Sections 313 and 319 is to prevent money laundering and financing of terrorist activities through correspondent accounts maintained by U.S. financial institutions on behalf of foreign banks. According to the Treasury Department’s final rule, which became effective October 28, 2002, for foreign accounts opened after October 2002, financial institutions had 30 days to comply—until the end of November 2002. For accounts opened before October 2002, financial institutions had until March 2003 to comply with the Treasury Department’s final rule. However, DSC has not issued or implemented examination procedures to ensure compliance with Sections 313 and 319.
  
  
• Section 314—Information Sharing. The Treasury Department issued a final ruling which became effective on September 26, 2002, requiring that financial institutions that share information among each other and with federal law enforcement agencies comply with certain reporting and recordkeeping requirements. The final rule, among other things, establishes a mechanism for law enforcement authorities to communicate names of suspected terrorists and money launderers to financial institutions in order to promptly locate accounts and financial transactions. After the final ruling, the FDIC issued FILs on March 14, 2002, November 27, 2002, and December 10, 2002. The March 14, 2002 FIL discussed the interim ruling issued by the Treasury Department. The FIL issued on November 27, 2002, notified financial institutions of a temporary moratorium on compliance with Section 314 authorized by the FinCEN. The FIL dated December 10, 2002, informed financial institutions of the new requirements regarding information sharing. Specifically, the FIL stated that each financial institution should (1) designate a point of contact and provide that point of contact to the Treasury Department and (2) notify FinCEN of the financial institution’s intent to share information on suspected terrorist and money laundering activities with other financial institutions. Neither the Treasury Department’s final rule nor DSC’s FILs designated a date upon which financial institutions had to comply with this ruling. Further, DSC has not issued or implemented examination procedures to ensure compliance with Section 314.

For the remaining section—Section 326—Customer Identification—the Treasury Department issued a final ruling on May 9, 2003, requiring institutions to adopt written identification programs. On May 27, 2003, the FDIC issued a FIL informing the institutions that the FDIC supervises of the new requirements regarding customer identification programs. As explained earlier, the section requires financial institutions to implement a customer identification program to verify the identity of customers who open new accounts. Financial institutions have until October 1, 2003 to comply with the rule by implementing a customer identification program. DSC has not issued or implemented examination procedures to ensure compliance with Section 326.

All four of the provisions are intended to facilitate the prevention, detection, and prosecution of criminal money laundering activities. For example, Sections 313 and 319 establish several regulatory mechanisms for controlling activity between U.S. financial institutions and foreign individuals or institutions. Specifically, the provision prohibits financial institutions from maintaining correspondent accounts with banks lacking a physical place of business and that are not subject to regulatory supervision. Section 314 encourages banks to share information among themselves and with law enforcement agencies concerning suspected money laundering and terrorist activities in order to facilitate the identification of accounts and transactions involving suspected terrorists and terrorist groups. Finally, Section 326 is intended to help financial institutions identify and maintain records of suspected terrorist or terrorist groups. Because of the significance of these provisions, further delays in implementation of examination procedures limit assurance that sound programs have been established by FDIC-supervised institutions to assist in the identification of potential terrorist financing activities.

CONCLUSION AND RECOMMENDATIONS

DSC’s efforts to issue new and/or revised examination procedures that will assess financial institutions’ compliance with the PATRIOT Act provisions included in Title III are, to some degree, dependent upon other entities and the DSC’s participation on the Steering Committee. Further, DSC’s efforts to ensure its examination procedures are consistent with those issued by other members of the Steering Committee are noteworthy. However, DSC could (1) accelerate its issuance of examination procedures (even for interim purposes) that relate to Title III provisions for which the Treasury Department has already issued final rulings—Sections 313, 314, 319, and 326—and (2) establish a mechanism to ensure that for future final rulings issued by the Treasury Department, the Corporation can more expeditiously issue examination guidelines concurrently with the Treasury Department’s rulings. The significance of the PATRIOT Act provisions included in Title III, which are meant to assess vulnerabilities to terrorists’ financing of activities worldwide, necessitate that financial institutions’ compliance with those provisions is a priority. Timely issuance of examiner guidance will help ensure institutions’ full compliance with PATRIOT Act provisions.

We recommend that the Director, DSC:

1. Issue interim examination procedures for those sections for which the Treasury Department has already issued final rules—Title III Sections 313, 314, 319, and 326.
   
   
2. Work with the FDIC-FRS-CSBS Steering Committee For Risk Focused Examination Procedures and Supporting Software to issue examination guidelines concurrently with the Treasury Department’s issuance of final rules for institutions’ implementation of Title III provisions.

CORPORATION COMMENTS AND OIG EVALUATION

On August 26, 2003, the DSC Director provided a written response to the draft report. The response is presented in Appendix VII to this report. DSC management concurred with both recommendations.

Recommendation 1: Issue interim examination procedures for those sections for which the Treasury Department has already issued final rules—Title III Sections 313, 314, 319, and 326.

DSC agreed with this recommendation. DSC issued interim guidance on August 15, 2003, entitled Bank Secrecy Act Examination Procedures. The guidance, which was effective on the date of issuance, was distributed to all FDIC examiners.

This recommendation is considered resolved, dispositioned, and closed.

Recommendation 2: Work with the FDIC-FRS-CSBS Steering Committee For Risk Focused Examination Procedures and Supporting Software to issue examination guidelines concurrently with the Treasury Department’s issuance of final rules for institutions’ implementation of Title III provisions.

DSC agreed with the recommendation. DSC is working with the FRB and the CSBS in the interagency examiner-guidance process. DSC further stated that the interagency Supervisory Process Committee suggested that interagency guidance be deferred for various reasons until after the committee’s November 2003 meeting. These reasons included additional rulemaking issues related to the USA PATRIOT Act and the length of time required to update the ED module application. As a result, DSC immediately began the process of issuing interim guidance to DSC examiners. That guidance was issued August 15, 2003—46 days before the planned completion date of September 30, 2003. In addition, DSC has a representative member on the Supervisory Process Committee who will raise the interagency examination guideline recommendations contained in this report at the next scheduled committee meeting. DSC expects that action to be completed no later than March 31, 2004.

This recommendation is considered resolved, dispositioned, and closed.

A summary chart showing management’s responses to all recommendations is presented in Appendix VIII.

APPENDIX I

OBJECTIVE, SCOPE, AND METHODOLOGY

The overall objective of this audit was to determine whether the Federal Deposit Insurance Corporation (FDIC) has developed and implemented adequate procedures to examine financial institutions’ compliance with the USA PATRIOT Act (PATRIOT Act). During this audit, we reviewed the FDIC’s Division of Supervision and Consumer Protection’s (DSC) efforts to implement the PATRIOT Act and revise its examination procedures to determine whether financial institutions comply with the PATRIOT Act.

To accomplish our objective, we held an entrance conference and interviews with DSC officials in Washington, D.C., and met with DSC officials periodically during the survey. Specifically, we interviewed officials in DSC’s Special Activities Section who are responsible for coordinating and monitoring DSC’s efforts related to implementing the PATRIOT Act. We also interviewed representatives of the FDIC’s Legal Division in Washington, D.C. In addition, we provided a copy of our draft report to representatives from the United States Department of the Treasury, Office of Inspector General, to obtain comments on issues included in the draft report that relate to the Treasury Department.

Further, we reviewed the DSC memorandum entitled FDIC-FRS-CSBS Steering Committee For Risk-Focused Supervision Examination Procedures and Supporting Software to obtain an understanding of the purpose, composition, responsibilities, and relationship to revising current examination procedures and issuing new procedures. We also reviewed FDIC Financial Institution Letters (FILs) and DSC memoranda to obtain an understanding of guidance provided to FDIC-regulated institutions and DSC’s safety and soundness examiners. The guidance related to examination procedures for the PATRIOT Act and Bank Secrecy Act (BSA) compliance.

To gain an understanding of examination procedures that the FDIC uses to determine compliance with the BSA and PATRIOT ACT, we reviewed the DSC Manual of Examination Policies which contain DSC policies and procedures related to safety and soundness examinations and its implementation of the BSA. More specifically, we reviewed examination procedures, included in the FDIC’s examination module for Anti-Money Laundering/Bank Secrecy Act (February 2001), that are used during the FDIC’s examinations of financial institutions to determine compliance with the BSA.

In addition, we reviewed examination procedures that DSC drafted in response to PATRIOT Act provisions. To determine the status of the FDIC’s draft procedures related to the implementation of the PATRIOT Act, we reviewed procedures that the FDIC had drafted, as of April 2003, and provided to the FRB for review. We also gained an understanding of the process that the FDIC uses to issue new examination procedures or revise existing procedures.

Finally, we reviewed applicable Federal Register publications, current news articles, and other agency and regulator reports and related documents to gain an understanding of banking regulators’ roles and responsibilities in implementing the PATRIOT Act; determine the status of the Treasury Department’s rulemaking (proposed, interim, and final rules) related to the PATRIOT Act; and obtain an understanding of the PATRIOT Act.

We gained an understanding of the management control activities associated with the implementation of the PATRIOT Act by reviewing DSC’s policies and examination procedures. Our testing for FDIC’s compliance with laws and regulations was limited to those sections of the PATRIOT Act applicable to the FDIC. To determine the relationship between, and similar requirements of, the PATRIOT Act and the BSA, we reviewed pertinent sections of those Acts in detail. We also reviewed the OIG’s audit report entitled Examination Assessment of Bank Secrecy Act Compliance (Audit Report Number 01-013, dated March 30, 2001). We reviewed that report to obtain an understanding of previous OIG audit work related to BSA.

In addition, we reviewed DSC’s performance measures under the Government Performance and Results Act, Public Law 103-62 (GPRA). We determined that the FDIC has established a corporate performance objective related to the PATRIOT Act and identified key milestones for implementing the PATRIOT Act. Specifically, the performance objective includes the following:

• implement appropriate policy guidelines and examination procedures to ensure compliance with provisions of the PATRIOT Act with a planned completion date of September 30, 2003 and
  
  
• implement appropriate systems to capture and transmit financial institution contact information to the Financial Crimes Enforcement Network (FinCEN) on an ongoing basis.

The limited nature of the audit objective did not require that we assess the possibility for fraud and illegal acts, and no instances of potential fraud and illegal acts came to our attention. In addition, because the FDIC has not yet incorporated any new or revised examination procedures into its safety and soundness examinations, we did not verify computer-processed data.

We reviewed synopses of results of the interagency working groups that the FDIC has participated in and work related to the PATRIOT Act that the FDIC has undertaken. We also reviewed the Treasury Department’s, including FinCEN’s, Web site to obtain background information on the PATRIOT Act and BSA.

In addition, we coordinated with the United States General Accounting Office, the FDIC OIG Office of Investigations, the OIG Counsel, and the DSC Internal Control and Review Section to determine whether there were any previous or ongoing audits, reviews, or investigations related to the implementation of the PATRIOT Act. Based on those contacts, we determined that other than the OIG’s BSA-related report referenced above, there was no prior or ongoing work related to the objective of this audit.

Further, we developed fact sheets on PATRIOT Act Title III sections that apply to the FDIC based on analyses provided by the OIG Counsel and the FDIC Legal Division. We asked the FDIC Legal Division and two DSC officials who were involved in the interagency discussions to review those fact sheets to determine the accuracy and applicability of data included in them. We revised those fact sheets, as appropriate, based on their comments.

APPENDIX II

COMPARISON OF PATRIOT ACT AND BSA REQUIREMENTS

Appendix II Table: Comparison of Patriot Act and BSA Requirements (Note: Some of the names of Title III Sections have been abbreviated for the purposes of this table.)

Source: OIG review of BSA examination procedures and PATRIOT Act Title III requirements.

APPENDIX III

ANALYSIS OF TITLE III SECTIONS APPLICABLE TO THE FDIC THAT RELATE TO EXAMINATION PROCEDURES (and the status of DSC’s development or revision of examination procedures for those sections)

(Note: Some of the names of Title III Sections have been abbreviated for the purposes of this appendix.)

Title III Section 311, Special Measures for Financial Institutions

Status of Rule (Proposed/Interim/Final) (Note: Unless otherwise noted, the Treasury Department is responsible for issuing rules necessary for enacting the provisions and necessitating compliance by the regulators.): Proposed rule issued April 2003
FDIC’s Communication to Financial Institutions: No FIL (Note: FDIC communicates proposed, interim, and final rules and other specific guidance through Financial Institution Letters (FIL).)
Section Requires New Procedures or Revisions to Existing Procedures: New examination procedures
Status of FDIC Procedures: Revisions drafted April 2003 (Note: DSC began drafting revisions to existing or new examination procedures during October 2002. The most recent revisions were made during April 2003.)
Comments: No final rule issued.

Title III Section 312, Special Due Diligence

Status of Rule (Proposed/Interim/Final): Interim final rule issued July 2002
FDIC’s Communication to Financial Institutions: No FIL
Section Requires New Procedures or Revisions to Existing Procedures: Revisions to existing procedures
Status of FDIC Procedures: Revisions drafted April 2003
Comments: No final rule issued.

Title III Section 313/319, Prohibition on U.S. Correspondent Accounts/Forfeiture of Funds (Note: The Treasury Department, FDIC, and the other regulatory agencies (Federal Reserve, Office of Thrift Supervision, Office of the Comptroller of the Currency, Securities and Exchange Commission, and Department of Justice) addressed rules for provisions 313 and 319 together.)

Status of Rule (Proposed/Interim/Final): Final rules issued September 2002 and December 2002 (Note: Final rule issued in December 2002 extended the date for compliance to March 2003.)
FDIC’s Communication to Financial Institutions: FIL for each section (313 and 319) issued December 2002
Section Requires New Procedures or Revisions to Existing Procedures: Revisions to existing procedures
Status of FDIC Procedures: Revisions drafted April 2003
Comments: For foreign accounts opened after October 2002, banks have 30 days to comply. For accounts opened before October 2002, banks have until March 2003 to comply.

Title III Section 314, Cooperative Efforts to Deter Money Laundering / Information Sharing

Status of Rule (Proposed/Interim/Final): Final rule issued September 2002
FDIC’s Communication to Financial Institutions: FILs issued March, November, and December 2002
Section Requires New Procedures or Revisions to Existing Procedures: New examination procedures
Status of FDIC Procedures: Revisions drafted April 2003
Comments: Establishes procedures that encourage information sharing between governmental authorities and financial institutions, and among financial institutions themselves. Financial institutions required to provide federal regulator with a point of contact for information requests.

Title III Section 325, Concentration Accounts at Financial Institutions

Status of Rule (Proposed/Interim/Final): No rule issued
FDIC’s Communication to Financial Institutions: No FIL
Section Requires New Procedures or Revisions to Existing Procedures: Revisions to existing procedures
Status of FDIC Procedures: Revisions drafted April 2003
Comments: Banking regulators provided the Treasury Department a draft of proposed regulations that have not been published for comment.

Title III Section 326, Verification of Identification

Status of Rule (Proposed/Interim/Final): Joint final rule issued-May 2003 (Note: Final rule for Section 326 was issued jointly with Federal Reserve, Office of Thrift Supervision, Office of the Comptroller of the Currency, Securities and Exchange Commission, and Department of Justice.)
FDIC’s Communication to Financial Institutions: FILs issued August 2002 and May 2003
Section Requires New Procedures or Revisions to Existing Procedures: Revisions to existing procedures
Status of FDIC Procedures: Revisions drafted April 2003
Comments: Financial institutions have until October 2003 to comply.

Title III Section 352, Anti-Money Laundering Programs

Status of Rule (Proposed/Interim/Final): Interim rule-November 2002
FDIC’s Communication to Financial Institutions: No final rule, no FIL
Section Requires New Procedures or Revisions to Existing Procedures: Procedures already require programs.
Status of FDIC Procedures: Not applicable
Comments: Current BSA examination procedures already fully address anti-money laundering program concerns.

Source: OIG review of PATRIOT Act Title III; FDIC’s FILs, BSA examination procedures, and draft PATRIOT Act examination procedures, as of April 2003; and applicable publications of the Federal Register.

APPENDIX IV

ANALYSIS OF TITLE III SECTIONS APPLICABLE TO THE FDIC THAT RELATE TO EXAMINATION PROCEDURES (that do not require revision)

(Note: Some of the names of Title III Sections have been abbreviated for the purposes of this appendix.)

Title III Section 327, Consideration of Anti-Money Laundering Record (Note: For Section 327 of Title III, the FDIC has issued a FIL discussing the significance of considering anti-money laundering laws and regulations in proposed merger transactions. Beginning January 1, 2002, the FDIC, in its evaluation of applications filed under Section 18(c) of the FDI Act, also known as the Bank Merger Act, began considering the anti-money laundering record of each involved insured depository institution in deciding the appropriateness of approving consent to merge.)

Status of Rule (Proposed/Interim/Final): Final rule not needed. Provision amended FDI Act.
FDIC’s Communication to Financial Institutions: FDIC issued FIL December 2001 and July 2002
Section Requires New Procedures or Revisions to Existing Procedures: Does not affect examination procedures. Refers to applications under Bank Merger Act.
Status of FDIC Procedures: Not applicable
Comments: FDI Act Section 18(c) amended. FDIC amended its Statement of Policy on bank mergers to consider anti-money laundering record of institutions requesting merger approval.

Title III Section 353, Penalties for Violations of Certain Recordkeeping Requirements

Status of Rule (Proposed/Interim/Final): Final rule not needed. Provision amended BSA.
FDIC’s Communication to Financial Institutions: No final rule or FIL
Section Requires New Procedures or Revisions to Existing Procedures: Does not affect examination procedures.
Status of FDIC Procedures: Not applicable
Comments: Expands BSA civil and criminal penalty provisions to include violation of regulations issued under Section 21 of the FDI Act.

Title III Section 354, Anti-Money Laundering Strategy

Status of Rule (Proposed/Interim/Final): Final rule not needed. Provision amended 31 U.S.C. 5341(b).
FDIC’s Communication to Financial Institutions: No action required
Section Requires New Procedures or Revisions to Existing Procedures: Does not affect examination procedures.
Status of FDIC Procedures: Not applicable
Comments: Added section to the Treasury Department’s National Money Laundering Strategy.

Title III Section 355, Authorization to Include Suspicions of Illegal Activity

Status of Rule (Proposed/Interim/Final): Final rule not needed. Provision amended FDI Act
FDIC’s Communication to Financial Institutions: No final rule or FIL
Section Requires New Procedures or Revisions to Existing Procedures: Does not affect examination procedures.
Status of FDIC Procedures: Not applicable
Comments: Section 18(w) of the FDI Act amended - Allows financial institutions to disclose potentially unlawful activity.

Source: OIG review of PATRIOT Act Title III; FDIC’s FILs, BSA examination procedures, and draft PATRIOT Act examination procedures, as of April 2003; and applicable publications of the Federal Register.

APPENDIX V

ACRONYMS

Appendix V Table: Acronyms

APPENDIX VI

GLOSSARY

Appendix VI Table: Glossary

APPENDIX V

CORPORATION COMMENTS

Federal Deposit Insurance Corporation
Washington, DC 20429
Office of the Director
Division of Supervision and Consumer Protection

August 26, 2003

MEMORANDUM TO: Stephen M. Beard, Deputy Assistant Inspector General for Audits

FROM: Michael J. Zamorski [Electronically produced version; original signed by Michael J. Zamorski], Director, Division of Supervision and Consumer Protection

SUBJECT: Draft Report Entitled FDIC’s Implementation of the USA PATRIOT Act (Assignment Number 2003-036)

The Division of Supervision and Consumer Protection (“DSC”) appreciates the opportunity to respond to the Office of the Inspector General’s (“OIG”) draft report regarding the FDIC’s Implementation of the USA PATRIOT Act. (Note: USA PATRIOT Act is the acronym for “United and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001.”) The overall objective of the audit was to “determine whether the FDIC has developed and implemented adequate procedures to examine financial institutions’ compliance with the USA PATRIOT Act. The draft audit report concludes with two recommendations:

1. Issue interim examination procedures for those sections for which the Treasury Department has already issued final rules—Title III Sections 313, 314, 319, and 326.

   DSC RESPONSE:

   DSC agrees with the recommendation and issued interim guidance on August 15, 2003, entitled Bank Secrecy Act Examination Procedures (attached). The guidance, which was effective on the date of issuance, was distributed to all FDIC examiners. Additionally, the guidance was reviewed by the audit team and deemed to address all relevant sections of the USA PATRIOT Act. In the revised guidance (hereafter referred to as BSA Examination Procedures), the following relevant Sections of the USA PATRIOT Act are covered:

   • Section 311, Special Measures for Financial Institutions. BSA Examination Procedures direct examiners to ensure financial institution compliance if special measures have been imposed by the Treasury Department against a foreign jurisdiction, institution, class of transaction(s), or type of account as a primary money laundering concern. If so designated, then the financial institution must take appropriate steps to comply with the special measures imposed by the Treasury.
     
     
   • Section 312, Special Due Diligence. BSA Examination Procedures include steps to review a financial institution’s due diligence related to private banking customers and internal correspondent banking relationships.
     
     
   • Sections 313 and 319, Prohibition on U.S. Correspondent Accounts. BSA Examination Procedures direct examiners to evaluate a financial institution’s process to identify suspicious activity in foreign correspondent accounts and includes measures for examiners to confirm that the financial institution has obtained the required documentation on foreign correspondent accounts within 30 calendar days after the date the account is established. Furthermore, the procedures require that the documentation should verify that the foreign correspondent bank is not a foreign shell bank and the U.S. correspondent account is not used to indirectly provide services to foreign shell banks. The guidance also instructs examiners to ensure that a financial institution documents procedures for closing or terminating foreign correspondent accounts, recertifying required documentation, and responding to written requests from federal law enforcement officers.
     
     
   • Section 314, Cooperative Efforts to Deter Money Laundering. BSA Examination Procedures require that examiners confirm whether financial institutions have programs to comply with Section 314(a) information requests, which include the following:
     
     
     • designation of an employee as the contact person responsible for handling Section 314(a) information requests;
       
       
     • procedures to ensure that all required records are searched, with positive hits reported to the Treasury Department’s Financial Crimes Enforcement Network (“FinCEN”) within designated timeframes; and
       
       
     • appropriate records to document search results.
       
       
   • Section 325, Concentration Accounts. BSA Examination Procedures include steps to review a financial institution’s special use or concentration accounts. Procedures include confirming that financial institutions assess the adequacy of internal controls that have been implemented to ensure the proper use of special use or concentration accounts and reviewing the nature of account activity for any suspicious or unusual activity. Additionally, the guidance directs examiners to confirm that the financial institution’s policy: (1) prohibits customers from directing the movement of funds through special use accounts; and (2) prohibits bank employees from disclosing the existence of a special use account to customers.
     
     
   • Section 326, Verification of Identification. BSA Examination Procedures address reviewing bank account opening procedures and customer due diligence guidelines. Furthermore, the guidance directs examiners to confirm that the financial institution’s board of directors adopts a written customer identification program for new accounts that includes: (1) specified customer identification information; (2) identification verification procedures; and (3) recordkeeping and retention procedures.
     
     
   • Section 352, Anti-Money Laundering Programs. BSA Examination Procedures require examiners to determine if a financial institution has adopted a written anti-money laundering program. The guidance directs examiners to determine whether the program contains a system of internal controls, independent testing for compliance, a designated qualified individual responsible for coordinating and monitoring daily compliance, and training for appropriate personnel.
   
   
   
2. Work with the FDIC-FRS-CSBS Steering Committee for Risk Focused Examination Procedures and Supporting Software to issue examination guidelines concurrently with the Treasury Department’s issuance of final rules for institutions’ implementation of Title III provisions.

   DSC RESPONSE:

   DSC agrees with the recommendation and is working with the Federal Reserve Board (“FRB”) and the Conference of State Bank Supervisors (“CSBS”) in the interagency examiner-guidance process. At the June 2003 Supervisory Process Committee Meeting, the Chairman of the Examination Documentation (“ED”) Module Maintenance Committee (also an employee of the FRB) stated that the interagency guidance should be deferred for discussion until the November 2003 meeting for various reasons. Those reasons included additional rulemaking issues related to the USA PATRIOT Act and the length of time required to update the ED module application. As a result, DSC immediately began the process of issuing interim guidance to DSC examiners. That guidance was issued August 15, 2003, a full 46 days before the planned completion date of September 30, 2003.

   DSC ACTION:

   DSC has a representative member on the Supervisory Process Committee. The member will raise the interagency examination guideline recommendations contained in this Report at the next scheduled meeting. This action will be completed no later than March 31, 2004.

   SUMMARY OF DSC RESPONSE TO RECOMMENDATIONS

   The revised BSA Examination Procedures, which were issued August 15, 2003, address all relevant provisions of the USA PATRIOT Act, and therefore satisfy the first recommendation. Additionally, interagency coordination has appropriately been referred to and is being handled by DSC’s Policy Branch. Although the interagency process is not within the control of DSC alone, we have proactively issued interim guidance that meets the needs of DSC staff as well as institutions regulated directly by the FDIC. Therefore, DSC believes that it has satisfactorily responded to the second recommendation.

   GENERAL COMMENTS

   In addition to issuing examiner guidance, DSC has issued six Financial Institution Letters (FILs) that address requirements of Sections 313, 319, 314, and 326. These FILs are directed to chief executive officers (CEOs) of state-chartered nonmember financial institutions, and DSC examiners receive copies of the FILs. Additionally, in October 2001, a confidential advisory was sent to CEOs of FDIC-supervised institutions to establish guidelines for communicating with the primary regulator and law enforcement; ultimately, this was the genesis for the Section 314(a) information-sharing process. Ongoing communications exist between DSC and state-chartered nonmember institutions related to Section 314(a) contact information and requirements. Finally, many regions have incorporated USA PATRIOT Act training into banker outreach programs and state banking regulatory conferences, while the Special Activities Section has provided specialized instruction at regional training conferences, trade group conferences and industry seminars, and to individual financial institutions and many foreign visitors. Overall, DSC has been proactive by participating in working groups that developed USA PATRIOT Act rules, providing technical assistance to bankers, and communicating USA PATRIOT Act requirements through various vehicles.

APPENDIX VIII

MANAGEMENT RESPONSES TO RECOMMENDATIONS

The following presents the management responses that have been made on recommendations in our report and the status of recommendations as of the date of report issuance. The information is based on management's written response to our report and subsequent communication with management representatives.

Please note the following definitions that relate to the management responses to the recommendations:

Resolved: (1) Management concurs with the recommendation and the planned corrective action is consistent with the recommendation. (2) Management does not concur with the recommendation but planned alternative action is acceptable to the OIG. (3) Management agrees to the OIG monetary benefits or a different amount, or no ($0) amount. Monetary benefits are considered resolved as long as management provides an amount.

Dispositioned: The agreed-upon corrective action must be implemented, determined to be effective, and the actual amounts of monetary benefits achieved through implementation identified. The OIG is responsible for determining whether the documentation provided by management is adequate to disposition the recommendation. Once the OIG dispositions the recommendation, it can then be closed.

Corrective Action: Taken or Planned/Status: DSC agreed with this recommendation. DSC issued interim guidance on August 15, 2003, entitled Bank Secrecy Act Examination Procedures. The guidance, which was effective on the date of issuance, was distributed to all FDIC examiners. This recommendation is considered resolved, dispositioned, and closed.

Expected Completion Date: August 15, 2003

Monetary Benefits: $0

Resolved -- Yes or No: Yes

Dispositioned -- Yes or No: Yes

Recommendation Open or Closed: Closed

Corrective Action: Taken or Planned/Status: DSC agreed with the recommendation. DSC is working with the Federal Reserve Board (FRB) and the Conference of State Bank Supervisors (CSBS) in the interagency examiner-guidance process. DSC issued interim guidance to DSC examiners on August 15, 2003. This recommendation is considered resolved, dispositioned and closed.

Expected Completion Date: August 15, 2003

Monetary Benefits: $0

Resolved -- Yes or No: Yes

Dispositioned -- Yes or No: Yes

Recommendation Open or Closed: Closed