Banking and Finance Law Daily Wrap Up, BANK SECRECY ACT—ABA response to AML/CFT proposed rule cautions against one-size-fits-all risk assessment process, (Oct 9, 2024)

By Patricia K. Ruiz, J.D.

The ABA stressed that the program rule should allow the agencies’ dynamic and responsive illicit finance threat detection.

In response to proposed rulemaking by the Office of the Comptroller of the Currency, the Federal Reserve Board, the Federal Deposit Insurance Corporation, and the National Credit Union Administration, the American Bankers Association (ABA) released a comment letter it sent to the agencies expressing disagreement with formalizing a new pillar to codify a nearly universal risk assessment practice for banks, arguing that it would not bring about meaningful reform. The proposed rulemaking would amend the Bank Secrecy Act (BSA) program rules, requiring the agencies’ supervised banks to establish, implement, and maintain “effective, risk-based, and reasonably designed” anti-money laundering/countering the financing of terrorism (AML/CFT) programs with certain minimum components, including the mandatory risk assessment process.

The agencies released its proposed rulemaking alongside a joint statement describing the proposed rules and additional steps the agencies believe are necessary to implement the Anti-Money Laundering Act of 2020 (see Banking and Finance Law Daily, July 22, 2024). The proposed changes were previously approved by the FDIC Board of Directors (see Banking and Finance Law Daily, June 21, 2024).

Recommendations. The ABA requested that the agencies make certain changes to the program rule. First, it recommended that the revised program rule adopt the language of the AMLA and direct that an effective, risk-based, and reasonably designed AML/CFT program focuses attention and resources in a manner consistent with the bank’s risk profile, taking into account higher-risk and lower-risk customers and activities, and ensures that more attention and resources are directed toward higher-risk customers and activities, rather than toward lower-risk customers and activities. Second, it recommended that the rulemaking ensure banks can continue to rely on multiple, individualized risk assessments and avoid forcing banks to divert compliance resources to inefficient paperwork and away from the actual threats the priorities are intended to address. The ABA reasoned that requiring a single formal, written risk assessment process and directing it to serve as the foundation for a risk-based AML/CFT program is contrary to the agencies’ objective of encouraging dynamic and responsive illicit finance threat detection.

Third, the ABA recommended that the agencies improve government feedback to banks regarding priority threats, working with the Financial Crimes Enforcement Network (FinCEN) to ensure regional federal law enforcement priorities and trends are provided to financial institutions on an ongoing and updated basis, while encouraging state and local law enforcement to do the same. The ABA requested that banks’ suspicious activity reporting (SAR) be incorporated with reported crime statistics and other information the government may have about illicit activity. Further, updating outdated currency transaction reporting rules would allow banks to focus resources on actual and emerging threats and away from collecting, documenting, and reporting non-suspicious currency transactions. The ABA recommended prioritizing guidance regarding threats and correlating it with the AML/CFT priorities the guidance is designed to address, as well as re-examining existing advisories to reaffirm, update, or phase them out consistent with the current threat environment.

Fourth, the ABA recommended that the agencies reduce excessive focus on mere technical compliance at the expense of effective BSA program operations. Finally, the ABA asked that the agencies allow banks two years to implement these changes by establishing an effective date of two years from the issuance of the final rule.

Additional requests. The ABA also make three additional requests of the agencies: (1) make all BSA program rule requirements and the supervisory expectations for banks identical; (2) release banks from any requirement or supervisory expectation to establish a single written risk assessment document solely to comply with the revised rule; and (3) provide additional specific and clear indicia of ways a bank can reasonably meet the new program requirements.

Companies: American Bankers Association

RegulatoryActivity: BankingOperations BankSecrecyAct CrimesOffenses GCNNews