FinCEN announces $8 million BSA enforcement action: The resurrection of AML penalties

The CBOT penalty is a solid reminder to all community financial institutions that a robust AML program is critical in guarding against money laundering and terrorist financing risks regardless of size and risk. The order uncovers nothing new to the industry. In fact, the bank was cited for many of the fundamentals of BSA, including: 

• Lack of a sound AML program: CBOT had an AML program, including AML monitoring software. However, program procedures were not adhered to in practice, and the AML program was deemed ineffective. 
• Inadequate staffing: The lack of technological and human resources will result in deficiencies in an AML program. The importance of adequate staffing has been drilled into BSA Officers for some time, and according to the consent order, CBOT's AML team was understaffed. Including the BSA Officer, there were 6-8 staff members, three of which were assigned to working AML alerts. The CBOT investigation determined that this was not an adequate number of analysts and that they were not thoroughly reviewing the documentation of each unusual activity alert. Each had a certain number of alerts to work per day, which was not possible without cutting corners. 
• Deficient customer due diligence (CDD): CDD is another "oldie but goodie" and possibly the most reported BSA violation. Although CBOT had a CDD program that included risk rating through their AML monitoring system and customer questionnaires by front-line staff, CDD procedures and processes were not followed. In addition, the CDD procedures were deemed deficient until revised in 2019, and CBOT did not conduct a lookback for possible higher-risk customers that may have been missed. 
• Ineffective ongoing monitoring: CBOT relied solely on its automated AML system for ongoing monitoring of accounts, including higher risk accounts.  The system would not trigger alerts if unusual activity was consistent with historical customer activity, allowing suspicious activity to remain undetected. CBOT failed to use other reporting capabilities for higher risk account monitoring which would have enhanced their ability to provide important information.  
• Insufficient automated alert monitoring: As stated, CBOT was considered understaffed on their AML team and could not keep up with the number of alerts generated by the AML monitoring system. The BSA Officer purposely reduced the number of cases by exempting customers from monitoring whose activity was "well-known," some of whom were later arrested or convicted of financial crimes. CBOT had no analysis, documentation, or justification for exempting these customers.  

• Automated templates for case closures: A preset list of reasons for closure was used by CBOT with no analysis or documentation as to why the reason for closing the case was used. An example cited in the consent order found that a customer with a previous SAR alerted on new activity. The preset reason of "A Suspicious Activity Report (SAR) was previously filed and is not due for review at this time" was used. While templates are not inappropriate and can improve efficiencies, they should not be used without verification and supporting documentation. 
• Unfiled SARs: Due to CBOT's poor implementation of their AML program, the BSA analysts neglected to investigate unusual activity alerts thoroughly. With the BSA Officer reducing the number of alerts by using exemptions, at least 17 SARs failed to be filed by CBOT. Emphasis on "at least" based on the deficiencies cited.