AML/BSA Audits

Federal Compliance and Defense Counsel Experienced in BSA/AML Audits

Attorney John W. Sellers
AML/BSA Audits Team Lead
Former DOJ Trial Attorney

Financial institutions that are subject to federal oversight are required to conduct Anti Money Laundering/Bank Secrecy Act (AML/BSA) independent testing (or auditing) as part of their efforts to maintain compliance on an ongoing basis. At Oberheiden P.C., we assist financial institutions throughout the United States with managing all aspects of BSA/AML compliance. This includes conducting BSA/AML audits, as well as fully documenting our clients’ audits and assisting with remedial measures as necessary.

According to the Federal Financial Institutions Examination Council (FFIEC), “a sound practice is for [a] bank to conduct independent testing generally every 12 to 18 months, commensurate with the BSA/AML risk profile of the bank.” To streamline their compliance efforts and ensure that they are able to address any compliance concerns as proactively as possible, most federally regulated banks and foreign banks conduct AML/BSA audits annually. Our lawyers can assist with determining what is appropriate for your financial institution, and then we can assist with putting the policies and procedures in place to facilitate efficient AML/BSA auditing and compliance management.

7 Key Aspects of AML/BSA Independent Testing

Conducting an BSA/AML audit is about much more than just “checking the box.” To serve their intended purpose of assessing and demonstrating compliance, AML/BSA audits must be thorough, custom-tailored, and independent. With this in mind, some of the key aspects of an effective AML/BSA audit program are:

1. Consideration of the Institution’s Risk Profile

Both the scope and frequency of an institution’s BSA/AML audits should be determined based on the institution’s risk profile. With regard to scope, comprehensiveness is key, and overlooking pertinent risks during the audit process and risk assessment can lead to both civil and regulatory exposure. For AML/BSA compliance purposes, a financial institution’s risk profile is determined based on its clientele, its location(s), the complexity of its operations, and its potentially suspicious activities, such as money laundering and terrorist financing (ML/TF) transactions, among other factors.

2. Evaluating Adequacy and Effectiveness of the Institution’s BSA/AML Compliance Program

The overarching purpose of independent testing is to evaluate the adequacy and effectiveness of the institution’s AML/BSA compliance program. At the conclusion of an audit, the institution’s leadership should be confident that they have a clear understanding of whether the institution is federally compliant.

3. Evaluating Adequacy and Effectiveness of the Institution’s SAR, CTR, and KYC Compliance Efforts

Along with evaluating the institution’s BSA/AML compliance program as a whole, an audit should also specifically evaluate the adequacy and effectiveness of the institution’s compliance efforts and customer due diligence in areas of high concern. These include submitting Suspicious Activity Report (SAR), Currency Transaction Report (CTR), and “Know Your Customer” (KYC) and Customer Identification Program (CIP) compliance, among others.

4. Transaction Testing (Vulnerability/Stress Testing)

Transaction testing is a critical component of the AML/BSA auditing process as well. This involves conducting test transactions and monitoring them through all touch points (or intended touch points) with the institution’s AML/BSA compliance policies, protocols, and procedures.

5. Evaluating Efforts to Implement Remedial Measures from Past Audits

If an BSA/AML audit uncovers the need for remedial measures, the institution’s subsequent AML/BSA audit should evaluate the remedial measures undertaken in response to the previously identified deficiency. This is critical, as failing to effectively address known deficiencies can significantly increase financial institutions’ risk of facing liability or penalties in the event of civil litigation or regulatory enforcement action.

6. Assessing the Integrity of Internal Documentation and External Reports

Another critical, yet often overlooked, aspect of BSA/AML auditing is assessing the integrity of the institution’s internal documentation and external reports. Our lawyers and consultants are experienced in identifying red flags for possible fraud and manipulation, and we can help ensure that your institution’s personnel are not misrepresenting material aspects of transactions or their role in managing AML/BSA compliance.

7. Assessing AML/BSA Training Effectiveness and Documentation

In this same vein, assessing the effectiveness of the institution’s BSA/AML training programs is essential as well. During the audit process, our lawyers and consultants will identify any breakdowns or shortcomings in the implementation of your institution’s AML/BSA compliance program as well as the subject matter expertise of the individuals who are responsible. We will also review your institution’s training documentation to ensure that it will be an asset (rather than a liability) in the event of civil or regulatory scrutiny.

Dr. Nick Oberheiden

Founder

Attorney-at-Law

Lynette S. Byrd

Former DOJ Trial Attorney

Partner

Brian J. Kuester

Former U.S. Attorney

Hon. Kevin McCarthy

55th Speaker, U.S. House of Representatives (ret.)

Government Consultant

Mike Pompeo

Of Counsel

Former U.S. Secretary of State

John W. Sellers

Former Senior DOJ Trial Attorney

Linda Julin McNamara

Federal Appeals Attorney

Nicholas B. Johnson

Former Prosecutor

Roger Bach

Former Special Agent (DOJ)

Chris J. Quick

Former Special Agent (FBI & IRS-CI)

Michael S. Koslow

Former Supervisory Special Agent (DOD-OIG)

Ray Yuen

Former Supervisory Special Agent (FBI)

Our AML/BSA Audit Services

When conducting BSA/AML audits for financial institutions, we take a comprehensive and custom-tailored approach focused on gathering the information and insights our clients need as efficiently as possible. To this end, our AML/BSA audit services include:

Scoping and Planning – We begin the AML/BSA independent testing process by defining the necessary scope of the audit and developing a strategic plan. We engage with our clients’ internal personnel as necessary to ensure that we have access to all of the resources and documentation we need to conduct a comprehensive and unbiased compliance assessment.
Consideration of the FFIEC Examination Manual – The FFIEC Examination Manual identifies areas of concern for federal regulators when assessing financial institutions’ BSA/AML compliance efforts. As a result, we consider this Manual (among many other compliance resources) when structuring and conducting our clients’ audits.
Remote and On-Site Assessment – We conduct our clients’ AML/BSA audits remotely when possible and on site when necessary. While we are often able to access much of the information we need remotely, having on-site access to our clients’ personnel and files can prove invaluable in many cases.
Documentation – We thoroughly document our clients’ BSA/AML audits as well as our conclusions from the audit process. Having this documentation on hand is essential when facing scrutiny from the FFIEC or other federal regulatory authorities, such as the Financial Crimes Enforcement Network (FinCEN) and Office of the Foreign Assets Control (OFAC).
Counseling and Advice – At the conclusion of every audit, we consult with and advise our clients’ leadership regarding our findings. If remedial measures are necessary, we identify the specific steps that our clients need to take, and we assist with taking these steps as desired.

As an outside law firm, Oberheiden P.C. meets the independence requirement for AML/BSA independent testing. Along with documentation of the audit process and our conclusions, we also provide our clients with the documentation they need to clearly demonstrate that our involvement in the audit process eliminates any concerns regarding bias or conflicts of interest.

FAQs: AML/BSA Audits

Do Banks Need to Conduct BSA/AML Audits Annually?

Federal regulations do not prescribe a specific frequency for AML/BSA auditing. Instead, as the FFIEC explains, “[a] bank may conduct independent testing over periodic intervals (for example, every 12-18 months) and/or when there are significant changes in the bank’s risk profile, systems, compliance staff, or processes.” As the FFIEC goes on to explain, “[m]ore frequent independent testing may be appropriate when errors or deficiencies in some aspect of the BSA/AML compliance program have been identified or to verify or validate mitigating or remedial actions.”

Do Banks Need to Engage Outside Counsel for AML/BSA Independent Testing?

While engaging outside counsel for BSA/AML independent testing is not strictly required, the “independent” aspect of this testing is essential. Engaging outside counsel ensures the independence of AML/BSA testing, while also helping to ensure that the audit process is comprehensive, effective, and well-documented. Oberheiden P.C. serves as outside counsel for financial institutions throughout the United States; and, in addition to senior attorneys, our team includes consultants and investigators who are knowledgeable about all pertinent areas of AML/BSA compliance.

Does the FFIEC Evaluate Financial Institutions’ BSA/AML Compliance Efforts?

Yes, the FFIEC evaluates financial institutions’ AML/BSA compliance efforts. This includes not only conducting its own assessments of institutions; AML/BSA compliance programs, but also assessing the efficacy of financial institutions’ independent testing (or auditing). As a result, effective internal auditing is essential for withstanding scrutiny from the FFIEC.

Can Banks Use In-House Personnel for AML/BSA Independent Testing?

Federal regulations allow banks to use in-house personnel for AML/BSA independent testing in appropriate circumstances. According to the FFIEC, “[b]anks that do not employ outside auditors or consultants or do not have internal audit departments may comply with [the independent testing] requirement by using qualified bank staff who are not involved in the function being tested.” With that said, there are inherent risks involved with relying on in-house personnel who may not be familiar with all pertinent AML/BSA requirements and auditing procedures. As a result, engaging experienced outside counsel for AML/BSA auditing is strongly recommended.

What Are the Risks of BSA/AML Non-Compliance?

The risks of AML/BSA non-compliance can be substantial for financial institutions of all sizes. Regulatory enforcement actions can lead to fines and administrative penalties, which can be crippling for many smaller institutions. Civil litigation involving AML/BSA non-compliance can lead to substantial liability as well—and both regulatory and civil actions can trigger additional federal scrutiny into other areas of a financial institution’s operations.

Speak with a Senior AML/BSA Audit Attorney at Oberheiden P.C.

If you would like more information about Oberheiden P.C.’s services as outside counsel for BSA/AML audits, we invite you to get in touch. One of our senior attorneys will be more than happy to speak with you about our practice and your financial institution’s needs. To schedule a complimentary consultation, please call 888-680-1745 or tell us how we can reach you online today.