Bank Secrecy Act (BSA) Audit

Bank Secrecy Act (BSA) Audit

The Bank Secrecy Act of 1970 (BSA), also known as the Currency and Foreign Transactions Reporting Act, requires financial institutions in the United States to assist government agencies in detecting and preventing money laundering and other financial crimes. The BSA mandates recordkeeping and reporting of certain transactions, including cash purchases of negotiable instruments over $10,000 and suspicious activity that may indicate money laundering, tax evasion, or other criminal activities. The BSA has been amended several times, including by the USA PATRIOT Act, and is sometimes referred to as "BSA/AML" (Anti-Money Laundering).

The board of directors and senior management are ultimately responsible for ensuring an effective BSA/AML internal control structure, including suspicious activity monitoring and reporting. Internal controls should be commensurate with the institution’s size, structure, risks, and complexity, and should address risks unique to specific lines of business or departments.

Objectives and Methodology

The objective of the BSA audit is to assess the adequacy of the institution’s BSA/AML compliance program, including both manual and automated controls, and to determine whether the institution has developed, administered, and maintained an effective program for compliance with the BSA and all implementing regulations. The audit methodology is based on the FFIEC’s BSA/AML Examination Manual and incorporates COSO-approved sampling standards.

• Evaluate the overall adequacy and effectiveness of the BSA/AML compliance program, including policies, procedures, and processes, and review OFAC compliance.
• Review the institution’s risk assessment for reasonableness given its risk profile (products, services, customers, entities, and geographic locations).
• Conduct risk-based transaction testing to verify adherence to BSA recordkeeping and reporting requirements (e.g., CIP, Beneficial Ownership, Reg GG, SARs, CTRs, CTR exemptions, and information sharing requests).
• Evaluate management’s efforts to resolve violations and deficiencies noted in previous audits and regulatory examinations.
• Review staff training for adequacy, accuracy, and completeness.
• Review the effectiveness of suspicious activity monitoring systems (manual, automated, or both), including related reports such as suspicious activity monitoring, large currency aggregation, monetary instrument records, funds transfer records, NSF reports, large balance fluctuation reports, and account relationship reports.
• Review Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) programs.
• Assess the process for identifying and reporting suspicious activity, including review of filed or prepared SARs for accuracy, timeliness, completeness, and policy effectiveness.
• Assess the integrity and accuracy of management information systems (MIS) used in the BSA/AML compliance program.

Scope of the Audit

BSA Governance

• Board and Senior Management Oversight
• Organizational Structure
• Risk Assessment Process
• Regulatory Compliance
• Testing and Audit Provisions
• Training and Awareness

BSA Operations

• BSA Policies and Procedures
• Customer Identification Program (CIP), including Beneficial Ownership and Regulation GG
• Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD)
• Suspicious Activity Reporting
• Currency Transaction Reporting and Exemptions
• Information Sharing
• Purchase and Sale of Monetary Instruments Recordkeeping
• Brokered Deposits (if applicable)
• Funds Transfers Recordkeeping
• Office of Foreign Assets Control (OFAC)
• Procedures for Products and Services (Bulk Shipments of Currency, Electronic Banking, ACH, Non-Deposit Account Activities, Lending Activities, Prepaid Cards, Trust and Asset Management)
• Procedures for Persons and Entities (Nonresident Aliens, Cash Intensive Businesses, Nonbank Financial Institutions, Politically Exposed Persons, Nongovernmental Organizations and Charities)
• Record Retention and Recordkeeping

BSA/AML Model Validation (Optional Service)

The BSA/AML Model Validation process is based on regulatory guidance including the Federal Reserve’s SR 11-7, OCC Bulletin 2011-12, FDIC FIL-22-2017, and FFIEC IT Booklets. Model risk is the potential for adverse consequences from decisions based on incorrect or misused model outputs and reports. NETBankAudit incorporates these key areas of risk into the model validation process.

Objectives and Scope

• Point-to-point transaction analysis to identify all input, output, and transactional points
• Hardware and software interface review, including configurations between BSA/AML MIS and other systems (core processing, teller, wire, ACH, etc.)
• Extensive testing using COSO and COBIT sampling standards, including source document to MIS report testing, daily transaction verification, balancing, and reconcilements
• Rule set and parameter review to ensure system rules are customized to the institution’s market and customer base, and that settings are appropriate
• Review of system cash aggregation and watch list scanning logic
• User and logical access review to ensure access is restricted to authorized users
• Data integrity review to ensure accurate input and output, segregation of duties, and independent review
• Vendor management review (e.g., SSAE 18, SOC reviews, internal audits)
• Transaction monitoring and filtering program review, including screening against watchlists, PEP lists, and negative news, and review of governance and training
• Annual certification review for the institution’s Board or Senior Management

BSA/AML Filter Analysis (Optional): An in-depth review of alert settings to identify efficiencies and recommend adjustments for improved analysis. This can be performed as a separate engagement or as part of the model validation.

Deliverables

• Letter to the audit committee and executive summary with overall evaluation, scope, objectives, and summary of findings
• Audit report with evaluation rating, control objective ratings, risk ratings, and prioritized issues and recommendations
• Audit workprogram(s) with detailed audit steps, risk-based testing, and analysis
• Electronic workpapers supporting the audit report and workprogram

All reports are confidential and may not be distributed without permission.

‍