Regulations


Solutions
 
 





Bank Secrecy Act
The Bank Secrecy Act (BSA), enacted in 1970, authorizes the Secretary of the Treasury to issue regulations requiring that financial institutions keep records and file reports on certain financial transactions.

Financial institutions currently subject to BSA reporting and recordkeeping requirements include depository institutions (e.g., banks, credit unions and thrifts); brokers or dealers in securities; money services businesses [MSBs (e.g., money transmitters; issuers, redeemers and sellers of money orders and travelers' checks; check cashers and currency exchangers)]; and casinos and card clubs.

Reports of Suspicious Activities
Requires certain financial institutions to file a Suspicious Activity Report (SAR) when they detect certain known or suspected violations of federal law or suspicious transactions related to a money laundering activity or a violation of the BSA.

Procedures for Monitoring BSA Compliance
Requires financial institutions to have a written, board approved program that is reasonably designed to assure and monitor compliance with the BSA. The program must, at a minimum: 1) provide for a system of internal controls to assure ongoing compliance; (2) provide for independent testing for compliance; (3) designate an individual responsible for coordinating and monitoring day-to-day compliance; and (4) provide training for appropriate personnel.

FinCEN Guidance and Frequently Asked Questions (FAQs)

BSA Forms

BSA Regulations and Proposed Rulemakings


Privacy | Information Notice     © Copyright 2010 Associated Banc-Corp

Anti-Money Laundering

USA PATRIOT Act
USA PATRIOT Act (which stands for "Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism"), was signed into law October 26, 2001.

The USA PATRIOT Act focuses primarily on money laundering which is the act of transferring illegally obtained money through legitimate sources so that its original source cannot be traced.

FFIEC Bank Secrecy Act Anti-Money Laundering Manual

Customer Identification Program Rule

Final Rule on Customer Identification Programs

Guidance on Customer Identification Programs

FDIC: FIL-34-2005: Guidance on Customer Identification Programs

Consumer Information on the USA Patriot Act

Special Information Sharing Procedures to Deter Money Laundering and Terrorist Activity

Final Rule Implementing Information-Sharing Section of USA PATRIOT ACT

Special Due Diligence for Correspondent Accounts and Private Banking Accounts

Final Regulation Implementing Section 312 of USA PATRIOT Act

Final Rule Implementing Sections of the USA PATRIOT Act that Address Correspondent Accounts for Foreign Shell Banks

Special Due Diligence Programs for Banks, Savings Associations, and Credit Unions

Minimum Due Diligence Requirements

Guidance on Enhanced Scrutiny for Transactions That May Involve the Proceeds of Foreign Official Corruption



Privacy | Information Notice     © Copyright 2010 Associated Banc-Corp

Data Breach Guidance

In March 2005, FFIEC issued “Guidance Programs for Unauthorized Access to Customer Information and Customer Notice

The Guidance interprets the Interagency Guidelines Establishing Information Security Standards (Security Guidelines) and states that each financial institution should implement a response program to address unauthorized access to customer information maintained by the institution or its service providers. The Guidance describes the components of a response program, including procedures to notify customers about incidents that involve unauthorized access to sensitive customer information.

Sensitive customer information means a customer’s name, address, or telephone number, in conjunction with the customer’s social security number, driver’s license number, account number, credit or debit card number, or a personal identification number or password that would permit access to the customer’s account. Sensitive customer information also includes any combination of components of customer information that would allow someone to log onto or access the customer’s account, such as user name and password or password and account number.

The Guidance provides that when a financial institution becomes aware of an incident of unauthorized access to sensitive customer information, the institution should conduct a reasonable investigation to promptly determine the likelihood that the information has been or will be misused. If the institution determines that misuse of its information about a customer has occurred or is reasonably possible, it should notify the affected customer as soon as possible.


Privacy | Information Notice     © Copyright 2010 Associated Banc-Corp

Currency Transaction Reporting

A bank must file a Currency Transaction Report (CTR) (FinCEN Form 104) for each transaction in currency (deposit, withdrawal, exchange, or other payment or transfer) of more than $10,000 by, through, or to the bank.

Aggregation of Currency Transactions

Multiple currency transactions totaling more than $10,000 during any one business day are treated as a single transaction if the bank has knowledge that they are by or on behalf of the same person. Transactions throughout the bank should be aggregated when determining multiple transactions. Types of currency transactions subject to reporting requirements individually or by aggregation include, but are not limited to, denomination exchanges, individual retirement accounts (IRAs), loan payments, automated teller machine (ATM) transactions, purchases of certificates of deposit, deposits and withdrawals, funds transfers paid for in currency, and monetary instrument purchases. Banks are strongly encouraged to develop systems necessary to aggregate currency transactions throughout the bank. Management should ensure that an adequate system is implemented that will appropriately report currency transactions subject to the BSA requirement.

Filing Time Frames and Record Retention Requirements

A completed CTR must be filed with FinCEN within 15 days after the date of the transaction (25 days if filed magnetically or electronically). The bank must retain copies of CTRs for five years from the date of the report (31 CFR 103.27(a)(3)).

CTR Backfiling

If a bank has failed to file CTRs on reportable transactions, the bank should begin filing CTRs and should contact the Internal Revenue Service (IRS) Enterprise Computing Center - Detroit (formerly the Detroit Computing Center) to request a determination on whether the backfiling of unreported transactions is necessary.

Money Services Businesses

Definition of an MSB

FinCEN and the federal banking agencies issued interpretive guidance on April 26, 2005, to clarify the BSA requirements and supervisory expectations as applied to accounts opened or maintained for MSBs. With limited exceptions, many MSBs are subject to the full range of BSA regulatory requirements, including the anti-money laundering program rule, suspicious activity and currency transaction reporting rules, and various other identification and recordkeeping rules. Existing FinCEN regulations require certain MSBs to register with FinCEN. Finally, many states have established supervisory requirements, often including the requirement that an MSB be licensed with the state(s) in which it is incorporated or does business.

The following regulatory expectations apply to banks with MSB customers:
  • The BSA does not require, and neither FinCEN nor the federal banking agencies expect, banks to serve as the de facto regulator of any type of NBFI industry or individual NBFI customer, including MSBs.
  • While banks are expected to manage risk associated with all accounts, including MSB accounts, banks will not be held responsible for the MSB's BSA/AML program.
  • Not all MSBs pose the same level of risk, and not all MSBs will require the same level of due diligence. Accordingly, if a bank's assessment of the risks of a particular MSB relationship indicates a low risk of money laundering or other illicit activity, a bank is not routinely expected to perform further due diligence (such as reviewing information about an MSB's BSA/AML program) beyond the minimum due diligence expectations. Unless indicated by the risk assessment of the MSB, banks are not expected to routinely review an MSB's BSA/AML program.
MSB Risk Assessment

An effective risk assessment should be a composite of multiple factors, and depending upon the circumstances, certain factors may be given more weight than others. The following factors may be used to help identify the level of risk presented by each MSB customer:
  • Purpose of the account.
  • Anticipated account activity (type and volume).
  • Types of products and services offered by the MSB.
  • Locations and markets served by the MSB.
Bank management may tailor these factors based on their customer base or the geographic locations in which the bank operates. Management should weigh and evaluate each risk assessment factor to arrive at a risk determination for each customer. A bank's due diligence should be commensurate with the level of risk assigned to the MSB customer, after consideration of these factors. If a bank's risk assessment indicates potential for a heightened risk of money laundering or terrorist financing, the bank will be expected to conduct further due diligence in a manner commensurate with the heightened risk.

Additional Money Services Business Guidance


Privacy | Information Notice     © Copyright 2010 Associated Banc-Corp