By now, large financial institutions have strong systems in place to prevent money laundering and follow the Bank Secrecy Act, (BSA) said Erich Schumann, founding partner for Boston-based consultancy Global Atlantic Partners. That’s good for them, but it means the bad guys are looking for easier targets, and turning their attention to smaller institutions – including credit unions.
“Credit unions are probably more vulnerable today than the large banks," Schumann told his audience at the Great New England Credit Union Show in Boxborough.
Schumann spelled out the best possible methods and systems for following the Bank Secrecy Act to regulators’ specifications. In general, he said, regulators want to know each institution has a strong system in place to prevent being unwittingly used in fraudulent schemes. If they don’t, they could easily face heavy fines in addition to regulator censure.
Credit unions must develop internal policies, have a designated compliance officer to oversee the process, have ongoing training for employees and board members, and lastly, complete regular independent reviews of BSA compliance.
Regulators want to see that each institution is being vigilant. That includes keeping an eye on customers and ensuring they are what they claim to be. A surprising array of members should be scrutinized: Unregulated charities, gambling operations and dealers in high-value goods – including real estate brokers – should all catch the attention of the BSA officer. Money moved through wire transfers, international sources and prepaid credit cards also deserve more attention, Schumann added.
Credit unions will need to demonstrate that they’ve done their due diligence in confirming members’ identities, and to fill out suspicious activity reports (SARs) when something seems amiss.
SAR narratives should include who the suspicious person is, when the activities occurred, where they happened, and why the BSA officer believes it’s suspicious. And the credit union can’t just file the report and go home, Schumann said – it needs to follow up continually for as long as the suspicious activity is ongoing.
