Banking as a Service

Implications for Community Banks 

Vendor Management is Critical 

We discussed the ways that Fintech companies are on a mission to “disrupt” financial services.   In this case, the disruption doesn’t necessarily have to be a negative connotation.  In fact, in many cases, the disruption that fintech are causing are geared towards improving product delivery.  At the end of the day, FinTechs are working to create efficiencies and deliver products with greater speed and flexibility, and this is ultimately a good thing for financial institutions. 

In addition to the disruptive nature of FinTechs, we also noted that these companies are aiming right at the large pool of unbanked and underbanked families. These are the households that not only represent potential customers for the current banking model, but they also represent financial institutions customer of the future.   There is a growing reliance on smart phones to conduct banking transactions.  In addition, customer expectation credit products continue to evolve.  Several platforms allow customers to apply for loans entirely online and with minimal human contact.   Even the idea of who is and is not a credit-worthy customer have changed.  Concepts such as collateral have changed; intellectual property can be a replacement for real estate in some cases.  As the needs and expectations of financial institution customers change, the manner which financial products are delivered must also change.  FinTechs are leading the change in these areas.

 

 

Despite their numerous advantages that FinTechs may have, there are inefficiencies in the regulatory scheme that have severely limited the growth and influence of these companies.   FinTechs are defined by the regulations as Money Service Business (“MSB’s”) and as such, they are required to get licenses in each of the states in which they transact business.  The process for obtaining these licenses can be tedious, time consuming and expensive.   A company may have to re-packing its information repeatedly to satisfy the application information requests for each state.  Of course, depending on the structure of the state agency and the resources available for processing applications, the process can take a long time to complete. 

 Many banks today rely on outsourced functions ranging from core operating systems to monthly billing programs.  The reliance on third parties to provide core functions at banks is no longer viewed as a less  than desirable situation, it is normal.  However, over time the types of relationships that banks began to form with outside vendors became more complicated and in some cases exotic.  Some banks used third parties to offer loan products and services that would otherwise not be offered.  In many cases, the administration of the contractual relationship was minimal; especially when the relationship was profitable.

The level and type of risk that these agreements created came under great scrutiny during the financial crisis of 2009.  Among the relationships that are most often scrutinized for areas of risk are:  

 

·        Third-party product providers such as mortgage brokers, auto dealers, and credit card providers;

·         Loan servicing providers such as providers of flood insurance monitoring, debt collection, and loss mitigation/foreclosure activities;

·         Disclosure preparers, such as disclosure preparation software and third-party documentation preparers;

·         Technology providers such as software vendors and website developers; and

·         Providers of outsourced bank compliance functions such as companies that provide compliance audits, fair lending reviews, and compliance monitoring activities.[1]

 

 The FDIC, the OCC and the FRB have all issued guidance on the proper way to administer vendor management.   While the published guidance from each of these regulators its own idiosyncrasies, there are clear basic themes that appear in each. 

 All of the guidance has similar statements that address the types of risk involved with third party relationships and all discuss steps for mitigating risks.  We will discuss the methods for reducing risk further in part two of this series. 

 Types of Risk Associated with Third-Party Relationships.

 

Regardless of the size of your bank, or the overall complexity of the operation, the risks that follow will exist at some level with any third-party relationship.  

 Operational Risk

 Operational risk is present in all products, services, functions, delivery channels, and processes.  Third-party relationships may increase a bank’s exposure to operational risk because the bank may not have direct control of the activity performed by the third party.

Operational risk can increase significantly when third-party relationships result in concentrations. Concentrations may arise when a bank relies on a single third party for multiple activities, particularly when several of the activities are critical to bank operations. Additionally, geographic concentrations can arise when a bank’s own operations and that of its third parties and subcontractors are located in the same region or are dependent on the same critical power and telecommunications infrastructures.

 Compliance Risk

 Compliance risk exists when products, services, or systems associated with third-party relationships are not properly reviewed for compliance or when the third party’s operations are not consistent with laws, regulations, ethical standards, or the bank’s policies and procedures. Such risks also arise when a third party implements or manages a product or service in a manner that is unfair, deceptive, or abusive to the recipient of the product or service. Compliance risk may arise when a bank licenses or uses technology from a third party that violates a third party’s intellectual property rights. Compliance risk may also arise when the third party does not adequately monitor and report transactions for suspicious activities to the bank under the BSA or OFAC. The potential for serious or frequent violations or noncompliance exists when a bank’s oversight program does not include appropriate audit and control features, particularly when the third party is implementing new bank activities or expanding existing ones, when activities are further subcontracted, when activities are conducted in foreign countries, or when customer and employee data is transmitted to foreign countries.

 Compliance risk increases when conflicts of interest between a bank and a third party are not appropriately managed, when transactions are not adequately monitored for compliance with all necessary laws and regulations, and when a bank or its third parties have not implemented appropriate controls to protect consumer privacy and customer and bank records. Compliance failures by the third party could result in litigation or loss of business to the bank and damage to the bank’s reputation.

Reputation Risk

 Third-party relationships that do not meet the expectations of the bank’s customers expose the bank to reputation risk. Poor service, frequent or prolonged service disruptions, significant or repetitive security lapses, inappropriate sales recommendations, and violations of consumer law and other law can result in litigation, loss of business to the bank, or negative perceptions in the marketplace. Publicity about adverse events surrounding the third parties also may increase the bank’s reputation risk. In addition, many of the products and services involved in franchising arrangements expose banks to higher reputation risks. Franchising the bank’s attributes often includes direct or subtle reference to the bank’s name.  Thus, the bank is permitting its attributes to be used in connection with the products and services of a third party.  In some cases, however, it is not until something goes wrong with the third party’s products, services, or client relationships, that it becomes apparent to the third party’s clients that the bank is involved or plays a role in the transactions. When a bank is offering products and services actually originated by third parties as its own, the bank can be exposed to substantial financial loss and damage to its reputation if it fails to maintain adequate quality control over those products, services, and adequate oversight over the third party’s activities.

Strategic Risk

A bank is exposed to strategic risk if it uses third parties to conduct banking functions or offer products and services that are not compatible with the bank’s strategic goals, cannot be effectively monitored and managed by the bank, or do not provide an adequate return on investment. Strategic risk exists in a bank that uses third parties in an effort to remain competitive, increase earnings, or control expense without fully performing due diligence reviews or implementing the appropriate risk management infrastructure to oversee the activity. Strategic risk also arises if management does not possess adequate expertise and experience to oversee properly the third-party relationship.

Conversely, strategic risk can arise if a bank does not use third parties when it is prudent to do so. For example, a bank may introduce strategic risk when it does not leverage third parties that possess greater expertise than the bank does internally, when the third party can more cost effectively supplement internal expertise, or when the third party is more efficient at providing a service with better risk management than the bank can provide internally.

 Credit Risk

Credit risk may arise when management has exercised ineffective due diligence and oversight of third parties that market or originate certain types of loans on the bank’s behalf, resulting in low-quality receivables and loans. Ineffective oversight of third parties can also result in poor account management, customer service, or collection activities. Likewise, where third parties solicit and refer customers, conduct underwriting analysis, or set up product programs on behalf of the bank, substantial credit risk may be transferred to the bank if the third party is unwilling or unable to fulfill its obligations

Managing Risk

 One of the most important points that all of the regulators are driving home is that they intend to hold financial institutions responsible for the action for the third party service providers.   For example, if an automobile dealer with whom a bank has a relationship engages in lending activities that have fair lending concerns, the bank under whose name they are providing the service will also be found to have fair lending concerns. 

 

This is not to say that there is a general distaste for outsourcing of third party arrangements.  It is to say that when the arrangement is made, there should be a risk management system in place ahead of the formation of the relationship.  The program should include at a minimum the following: 

 

·         A Risk Assessment;

·         Due Diligence in Selecting a Third Party;

·         Contract Structuring and Review;

·          Oversight;  

 

 

 

 

 

---

[1] See Vendor Risk Management — Compliance Considerations

By Cathryn Judd, Examiner, and Mark Jennings, Former Examiner, Federal Reserve Bank of San Francisco 

[2] FDIC Compliance Manual

[3] OCC BULLETIN 2013-29 Managing Third Party Relationships

                                                                 Banking as a Service

Implications for Community Banks

Part Three Choose Your Partner Wisely

 

 

For a community bank that is considering developing banking as s service, there are several issues to consider.  While the overall public impression of banks and financial institutions took a major hit during the 2008 financial crisis, in large part, the damage was being slowly repaired.   However, it is obvious that the relationship between financial institutions and the public has changed forever.  Even before the coronavirus hit the economy, a broad wave of consumer distrust buffeted the banking industry's reputation.   Let's face it, the current times are not exactly the best for the image of banks.   In addition to the mortgage crisis, there have been several highly publicized scandals involving some of the larger and best-known banks. 

 

As pointed out in Bankshot^[1] banking journal- “What’s at stake? Customers have more choice than ever when it comes to where they do their banking, including from an increasing array of fintech competitors with arguably less cultural and emotional baggage than the traditional banking industry.   Now, more than ever before, there are real alternatives to banking.   

 

The need for nontraditional banking services is one of the main drivers of the financial technical “fintech” industry.  Many bankers seem to understand that fintech companies present the possibilities for significant change in the industry.  According to a survey conducted by PWC:

 

• FinTech is a driver of disruption in the market. Financial Institutions are increasingly likely to lose revenue to innovators, with 88% believing this already is occurring. The perceived business at risk trend has continued to rise, to 24% on average this year among all sectors.
• Incumbents are becoming more aware of the disruptive nature of FinTech, shown well by the fact that, in 2017, 82% of North American participants believe that business is at risk, up from 69% in 2016. Insights from PwC’s DeNovo also indicate that 30% of consumers plan to increase usage of non-traditional Financial Services providers and only 39% plan to continue to use only traditional Financial Services provider.  In addition, asset backed lenders have largely increased their share of lending (the lending club and other peer-to- peer business).  
•  

Fintech companies have been in the business of designing products that address some of the concerns raised by the unbanked or underbanked.  For example, speed of delivery, consideration of alternative means for credit underwriting and ease of delivery.

 

Despite the idea that fintech equals disruption, it doesn’t have to be a negative thing.  Disruption often results in improvement in efficient and better service.   In fact, there are several places where fintech companies and financial institutions, especially community banks have converging interests.

Community banks and credit unions have overall higher levels of trust and a better public image than their larger brethren.   Because community banks are smaller, they are nimbler and making changes to products lines can happen quickly and in response to customer needs.   The independent bankers association published the “Fintech strategy Roadmap in 2017” as a guide for the many opportunities that fintech companies can present.   A summary of these opportunities includes;  

• Increased Operational Efficiency and Scale
• Increased Access to Customers with a Younger Age Demographic
• Increased Access to Loan Customers in New Markets
• Enhanced Brand Reputation
• Enhanced Customer Experience

 

Disruption is simply that- it doesn’t necessarily have to be a bad thing.   In fact, disruption can result in greater efficiencies and more effective.  Some good news, these companies have done all of the research and development work with venture capital funds!   They have worked out a lot of the bugs that are usually part of delivery of a new product.   Some more good news, these companies are burdened by a regulatory scheme that really limits them.  That is that they are considered MSB’s and must get state licenses to operate in each state.  Because of this, many FinTechs are looking for a partnership with a bank- in this way they get around the need for licenses.  

 

Successful collaboration means having a risk assessment, strategic plan and most importantly, strong vendor management.    The FDIC, the OCC and the FRB have all issued guidance on the proper way to administer vendor management.   While the published guidance from each of these regulators its own idiosyncrasies, there are clear basic themes that appear in each.   All of the guidance has similar statements that address the types of risk involved with third party relationships and all discuss steps for mitigating risks.  

 

One of the considerations that are necessary is about what level of due diligence is required for a third-party contract.  The level of due diligence is heavily impacted by determination of whether the activity being considered is a critical activity.  The OCC guidance defines a critical activity as:

•      Critical activities—significant bank functions (e.g., payments, clearing, settlements, custody) or significant shared services (e.g., information technology), or other activities that could cause a bank to face significant risk if the third party fails to meet expectations;

•      Could have significant customer impacts require significant investment in resources to implement the third-party relationship and manage the risk; 

•      Could have a major impact on bank operations if the bank has to find an alternate third party or if the outsourced activity has to be brought in-house.^[2]

 

 

 

 

The steps that are necessary for the proper engagement of a third party for a critical activity are discussed in each of the regulatory guidance documents that have been released.  The OCC bulletin provides the most comprehensive list that includes: 

 

 

•      Relationship Plan:  Management should develop a full plan for the type of relationship it seeks to engage.  The plan should consider the overall potential risks, the manner in which the results will be monitored and a backup plan in case the vendor fails in its duties. 

•      Due Diligence:   The bank should conduct a comprehensive search on the background  of the vendor, obtain references, information on its principals, financial condition and technical capabilities.   It is during this process that a financial institution can ask a vendor for copies of the results of independent audits of the vendor.    There has recently been a great deal of attention given to the due diligence process for vendors.  Several commenters and several banks have interpreted the guidance to require that bank research a vendor and all of its subcontractors in all cases.  We do not believe that this is the intention of the guidance.  It is not at all unusual for a third-party provider to use subcontractors.   We believe that a financial institution should get a full understanding of how the subcontracting process works and consider that as part of the due diligence, however, it impractical to expect a bank to research the backgrounds of all potential subcontractors before engaging a provider.  

•      Risk Assessment:  Management should prepare a risk assessment based upon the specific information gathered for each potential vendor.  The risk assessment should compare the characteristics of the firms in a uniform manner that allows the Board to fully understand the risk associated with each vendor.  ^[3]

•      Contract Negotiation:  The contract should include all of the details of the work to be performed and the expectations of management.  The contract should also include a system of reports that will allow the bank to monitor performance with the specifics of the contract.   Expectations such as compliance with applicable regulations must be spelled out.   

•      Ongoing Monitoring:   Banks must develop a program for ongoing monitoring of the performance of the vendor.   We recommend that the monitoring program should include not only information provided by the vendor, but also internal monitoring including

•      Customer complaints:  Customer complaints are a direct indication of issues or problems within a program or product offering.  A system that tracks complaints and their resolution is a critical component of evaluating the overall effectiveness of a program.

 

•      Oversight and Evaluation:  There should be a fixed period for evaluating the overall success and efficacy of the vendor relationship.  The Board should, on a regular basis evaluate whether the relationship with the vendor is on balance a relationship with keeping.  

 

---

[1] https://www.americanbanker.com/bankshot

[2] OCC BULLETIN 2013-29

[3] Ibid. 

Banking as a Service- Implications for Community Banks

Part Two- Technology is the Key

 

 

In the first blog in this series, we discussed the overall concept of Banking as a Service (“BaaS”).  A recent Cornerstone Advisors survey of bank executives found that one in 10 banks is in the process of developing a BaaS strategy and another 20% are considering pursuing a BaaS strategy.  This is only likely the beginning!  There are a couple of major factors that are driving the need for BaaS. 

 

First, as we noted in the first blog- cellphones are ubiquitous and as a result mobile banking applications are growing.   In addition to that, the number of unbanked and underbanked households presents an opportunity. There is a huge pool of potential customers for financial institutions.  This pool represents a large source of potential income that is untapped.   The pool we are referring to is the large number of unbanked and underbanked households in the United States. 

 

Who are the Unbanked and Underbanked?

 

The unbanked have no ties to an insured economic institution. Essentially, they have no checking or savings account and no debit or ATM card.   Meanwhile, the underbanked do use some of these services – often a checking account – but they also used alternative financial options within the past year.   This population has been estimated to be as many as 30 million people. Around 20 percent of Americans are underbanked, according to the FDIC, which means they have either a checking or savings account, though rarely both. Households are also usually given the underbanked distinction if they've used alternative financing options during the previous year, such as money orders or rent-to-own services. Around 67 million Americans are underbanked, or the equivalent of 24.5 million households, based on 2019 figures from the most up to date FDIC survey.[1]

 

Just as important as the number of people who are unbanked and underbanked are the reasons that they have limited contact with banks.   The most recent FDIC study on the unbanked and underbanked was published in 2019.  In the study, the main reasons for not having bank accounts included:

 

·         Do not have enough money to keep in an account”.    

·         Don’t trust banks”

·         Bank account fees are too high

·         Bank account fees are unpredictable”

·         Higher proportions of unbanked households that were not at all likely or not very likely to open a bank account in the next 12 months cited “Don’t trust banks” (36.2 and 31.5 percent, respectively) in 2019, compared with unbanked households that were somewhat likely or very likely to open a bank account in the next 12 months (24.7 and 21.0 percent, respectively).[2]

 

When we put this all together there is a huge market opportunity for banking as a service.   This is where the FinTechs and banking comes together.  And the way they do so is through technology; including API’s and BaaS infrastructure that allows for widespread adaptation of the products and services that are being designed and offered.  

 

 

API’s

 

These are software programs called application programming interfaces.  This is a fancy word for patches that allow different forms of data to recognize each other.  In the real world an API is like the adapter that you put on a three-pronged plug to make it fit into two pronged outlets.  

Financial API’s are specifically designed to allow financial data to be shared between entities that naturally would want to share data- for example, your bank account and Turbo Tax. 

 

There are three types of API’s

·          Internal – these generally don’t touch activity that is consumer facing.  They are designed to help the flow of internal information with an organization

·         Partner – these are API’s that connect to distinct businesses-organizations.  These are the API’s that are most often used by banks that want to offer specific products and services

·         Open- These are the applications that allow financial data to third party service providers.  These are the applications that allow a person to be offered direct pay for bills and subscriptions

 

The development of API’s has made it possible for banks to apply technology that was unavailable in the past.  

 

Infrastructure

 

These software platforms allow banks to take full advantage of API’s and to offer new and innovative products and services.  Reasons why infrastructure is necessary include

·         Costs of development

·         Resources and organizations that are not designed for software development

·         Technology that isn’t compatible

 

BaaS infrastructure providers have begun to ramp up their services – these will be needed partners as the industry develops.    We will discuss the aspects of vendor management in a later blog.  

 

 

 

 

---

[1] FDIC National Survey of Unbanked and underbanked Households

 

[2] Unbanked versus underbanked: Who they are and how they differ.  Dec, 23, 2017 Waly Wojciechowski 

  

 

 

 

 

 

 

Banking as a Service- What it means for Community Banking

 

 

Introduction

 

One of the hottest topics in the financial service industry todays is the development of the are called “Banking as a Service” (“BaaS”).   Put in it most simple terms, BaaS is the combining of a financial services platform with digital access to a banking account.  Banking as a Service platforms allow non-bank financial institutions to offer all kinds of financial products.  You may have seen some of the products if you recently purchased an airline ticket, or large appliance.  When you proceed to check out, you get a notice that you can (on approval), finance the purchase and pay installments rather than paying the whole price right away.  

 

There are several firms that are no providing point of sale financing that allow for short term installment loans to pay for larger purchases.  This is a form of BaaS. 

 

For community banks, the growth of BaaS can present both an opportunity and a potential challenge.  As an opportunity, BaaS presents the ability to reach out to a much larger number of customers who have been unbanked and underbanked and offer services and products at a reasonable cost.

 

FinTechs as the Basis for BaaS

 

We hear a lot about fintech companies financial technology, also known as FinTech, is a line of business based on using software to provide financial services. Financial technology companies are generally, startups founded with the purpose of disrupting incumbent financial systems and corporations that rely less on software.

 

The overall goal of Fintech companies include:

 ·       Efficient and speedy delivery of funds

·        Development of alternate means of solutions for ongoing problems

·         Especially in the financial industry there are a lot of naysayers, but the fact of the matter is that there are structural reasons for the potential success of FinTechs.    Underbanked and unbanked people represents a huge potential market.   The FDIC produces a great deal of information about the unbanked and underbanked every two years. The study is called 2019 FDIC National Survey of Unbanked and Underbanked Households.   As of 2019, the combined number of unbanked and underbanked was almost 30 million people. 

 Fintech companies are pointed directly at the needs of the underbanked and unbanked

 

·         When thinking of a fintech, it is important to note that what they are trying to do is to get money to people is a manner that is both fast and cheap

·         FinTechs are also working on ways to meet the needs of a large group of people who are outside of the banking industry

·         Fintech companies understand that while not everyone has a banking account, mostly everyone has a cell phone or a similar electronic device

 

Using this technology, fintech companies are reducing the need for bank accounts. FinTech companies are really going after this population of people who for the most part are potential bank customers by providing solutions to problems that people have with banks.   One of the things that Fintech companies have focused on are the many uses of the smartphone.   For example, smartphones can be used for stored value.  That is, just like a reloadable debit card, the smartphone can be used to reload value repeatedly.  Fintech companies such as Zoom, Square and Amazon is making it possible to transfer funds and store funds.  Other Fintech companies are changing the way that credit is underwritten.  Fintech also has increased a small institutions ability to offer different products and services.  As traditional means for profit become scarcer, Fintech opens the possibilities for additional income streams. 

 

The 30 million people in the underbanked and unbanked populations are your potential customers!  The statistics show that this group is getting younger and more internet savvy.  The more that the customers use their smartphones, the less likely they are to rely on banks

 

Some examples of the many uses of a smartphone in the fintech industry includes the following:  

·        Stored Value  - A stored-value the card is a payments card with a monetary value stored on the card itself, not in an external account maintained by a financial institution.  Stored-value cards differ from debit cards, where the money is on deposit with the issuer, and credit cards which are subject to credit limits set by the issuer.

·         APIs - An open API is a publicly available application programming interface that provides developers with programmatic access to a proprietary software application or web service. APIs are sets of requirements that govern how one application can communicate and interact with another.

·         Nationwide Reach- Using data analytics, fintech companies can have access to customer behavior data and assist with marketing opportunities

 

For many of the unbanked, fintech companies represent a much-welcomed alternative to the use of high-cost check cashers.  In addition, there are companies that are taking on Payday lenders who up to this point have not had a great deal of competition. One of the other things that these companies do is give financial institutions the ability to offer products and services

Information is power and even for a small institution, if you are unaware of what your customers want and are going to want in the future, it is a problem.  The regulatory agencies that cover financial institutions have recognized this synergy and have issued guidance and taken steps that are designed to ease the process for relationships between financial institutions and Regtech companies.  These included:

 

·         Regulators are encouraging institutions to pool resources when it is feasible

·         Joint Statement on Banks and Credit Unions Sharing Resources to Improve Efficiency and Effectiveness of Bank Secrecy Act Compliance was issued in October of 2018

·         One of the main points of the statement is that there are ways that financial institutions can leverage what other banks or firms are doing

·         Fintech companies have the ability to help in a number of ways.  Some of these companies have developed programs that are help with analytics and security

·         The Office of the Comptroller of the Currency has initiated the Fintech charter program that was designed to allow Fintech companies to have special banking powers.  This charter has been called into question by a decision of a federal court that is now undergoing appeal. 

 

Regardless of the outcome from the appeal of the Fintech charter, the regulatory agencies have noted that fintech and banking are a natural combination that will continue to grow and in scope and activity. 

                                            BSA in a Fintech World 

There are two areas that will always be among the “hot topics” when it comes to compliance.  The first is an institutions’ system for compliance with the requirements of the Bank Secrecy Act/Anti-Money laundering (“BSA/AML”) laws.   Regulated financial institutions have been well aware of the fact that a well-developed system for compliance is a critical component of ongoing operations.  A second area that is becoming increasingly important is the use of technology to transact business by financial institutions.  This area is often known as “fintech”.   Although fintech is often a broadly used term, there are generally accepted definitions such this one offered by Fintech magazine:   

Financial technology, also known as FinTech, is a line of business based on using software to provide financial services. Financial technology companies are generally startups founded with the purpose of disrupting incumbent financial systems and corporations that rely less on software.[1]

PayPal, Apple Pay and Venmo are just a few examples of popular software applications that allow consumers to transfer money to one another with a just a few relatively easy steps.    

As the number of firms that offer variations of fintech transactions grow, so does the need for a financial institutions’ BSA/AML system to adapt.  

The Heart of BSA/AML- CIP and KYC

Although there are numerous components that make up a strong and complete BSA compliance program, the heart of all programs is the ability of the financial institution to know complete information about its customers.   The two components of the BSA program that perform this function are the Customer Identification program (“CIP”) and the Know Your Customer (“KYC”) programs.  The CIP program is made up of the policies and procedures established by an institution for the purpose of collecting identifying information about their new customers.  The FFIEC BSA manual details the requirements of the CIP regulation and notes that at a minimum, a financial institution must obtain the following information before opening an account:

·         Name

·         Date of birth for individuals.

·         Address.

·         Identification number.[2]

 

There are well established rules for the types of identification that are considered acceptable.  The goal of the CIP program must be that a financial institution has to establish with a reasonable certainty that the person who is attempting to open an account is who they say they are.  For business accounts, the requirements are the same although the form of identification takes on different forms e.g., name would be the legal name of a business and identification number would be the tax identification number.  

Once the identity of a customer is established; the KYC portion of a compliance program comes into play.  Depending on the types of transactions that the customer says that they will conduct additional information is necessary.  For example, if the customer is a flower shop, then information about how long they have been in business, who their customers are, how the flowers are sold and the means for payment, etc. are all pieces of information that are necessary for a financial institution.  Using this information, the financial institution can keep transactions conducted by the customer in context.  In other words, if the flower shop sells mostly orchids, it is reasonable that there would be wires to regions of the country where orchids are grown.  

It is through CIP and KYC that all of the information that gathered on a client is filtered.   Individual transactions may or may not be considered suspicious based upon the KYC and CIP obtained about a client.  Using the flower shop example above, wires or ACH activity to war-torn regions of the world would seem at least very unusual for orchids.  

CIP and Unintended Consequences

The need for complete CIP and KYC has been at the heart of a delicate balancing act for financial institutions and the customers that they serve.  The FDIC separates people who do not use banks to fully serve their financial needs into two distinct categories. The unbanked have no ties to an insured economic institution. Essentially, they have no checking or savings account and no debit or ATM card. Meanwhile, the underbanked do use some of these services – often a checking account – but they also used alternative financial options within the past year. 

When customers are the “unbanked” and “underbanked” communities, the issue of complete documentation of identification can be tricky.  These customers may not have complete or traditional documentation available. For many institutions, the clash between the desire to serve underbanked and unbanked and the need for complete documentation has created an unintended consequence.    The law of unintended consequences is defined as:

The law of unintended consequences is the outgrowth of many theories, but was probably best defined by sociologist Robert K. Merton in 1936. Merton wrote …a treatise which covers five different ways that actions, particularly those taken on a large scale as by governments, may have unexpected consequences. These “reactions,” may be positive, negative or merely neutral, but they veer off from the intent of the initial action.”

 

In the case of BSA, the desire to monitor and mitigate risk had the unintended consequence of shutting out entire industries that often are critical to unbanked or underbanked communities.  MSB’s such as combination grocery stores and check cashers often serve as the bank and remittance service for migrant workers and expatriates of other countries.  When the local bank makes a decision to stop proving services to these entities, the customers of the MSB are forced into transactions with entities that are completely underground.  

Fintech to the Rescue? 

Fintech companies have developed many products that allow customers to have many of the same services and abilities as a bank account.  Digital wallets for example, allow customers to receive payroll, reload debit cards, payment bills and purchase gift cards among other things.   These platforms also allow customers to send wires, ACH’s or other transfers.  

 

The very nature of fintech relationship is often that the customer and the provider are not in physical contact with one another.  The identification process is completed through various means such as texts to telephones, IP address verification and scanned copies of documents.   The ability of fintech companies to discern fraud and detect unauthorized use of an account has become increasingly adept.    

The development of fintech products gives financial institutions that opportunity to reach out to customers that have been largely overlooked due to BSA/AML concerns.  The time has come to reconsider the possibilities.

For a detailed review of how Fintech can improve overall Community Reinvestment Act performance, non-interest income and BSA/AML compliance please go to www.vcm4you.com and fill out the “Contact Us” form

---

[1] FinTech – A definition by FinTech Weekly https://www.fintechweekly.com/fintech-definition 

[2] See FFIEC BSA examination manual – Customer Identification Program- Overview

 Why ARE There BSA/AML Regulations?

 

 

 

As anyone in compliance can attest, there are myriad consumer compliance regulations.  For financial institutions, these regulations are regarded as anything from a nuisance, to the very bane of the existence of banks.  However, in point of fact, there are no bank consumer regulations that were not earned by misbehavior in the past.  Like it or not these regulations exist to prevent bad behavior and/or to encourage certain practices.   We believe that one of the keys to strengthening a compliance program is to encourage your staff to understand why these regulations exist and what it is the regulations are designed to accomplish.  To further this cause, we have designed a series of blogs that from time to time throughout the year, will address these questions about various banking regulations.  We call this series “Why is there….” 

BSA- the Early Years-

Since the beginning of crime, there has been a need to hide the ill-gotten gains of criminal activity.  Early bad guys held their loot in caves.  Later, treasure chests provided a means of hiding criminal wealth.   However, despite the form that ancient loot took, the goal was and has always been to reduce assets to currency so that it can be used in exchange for other goods and services.   The need to take illicit assets or money and hide its source is known commonly as “money laundering”.  Criminals of all sorts engage in money laundering and have become exceedingly sophisticated in their pursuit of hiding the sources and uses of their money.  

Because the “bad guys’ continue to evolve, the history of the Bank Secrecy Act (“BSA”) and Anti-Money Laundering laws (“AML”) is one of ongoing change.  The laws that make money laundering illegal can be traced back to the Bank Secrecy Act of 1970.   Since the time the BSA was passed, there have been seven major legislative changes to the overall legislative scheme that covers this area.  These changes are;

 

·     Money Laundering Control Act (1986)

 

·     Anti-Drug Abuse Act of 1988

 

·     Annunzio-Wylie Anti-Money Laundering Act (1992)

 

·     Money Laundering Suppression Act (1994)

 

·     Money Laundering and Financial Crimes Strategy Act (1998)

 

·    Intelligence Reform & Terrorism Prevention Act of 2004

 

·    Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and  Obstruct terrorism

 

As technology has changed, so have the goals of many of the criminals that want to launder money.  In addition to drug dealers, there are terrorists, human traffickers, politicians and embezzlers, all of whom are developing ways to hide their cash. 

Money Laundering

What exactly is money laundering?  Well, FinCEN, which is the federal agency that is specifically charged with monitoring and preventing money laundering defines it this way; 

Money laundering is the process of making illegally-gained proceeds (i.e. "dirty money") appear legal (i.e. "clean"). Typically, it involves three steps: placement, layering and integration. First, the illegitimate funds are furtively introduced into the legitimate financial system. Then, the money is moved around to create confusion, sometimes by wiring or transferring through numerous accounts. Finally, it is integrated into the financial system through additional transactions until the "dirty money" appears "clean." Money laundering can facilitate crimes such as drug trafficking and terrorism, and can adversely impact the global economy.[1]

 

Put another way, when criminals conduct their business, they almost always do so in cash, for what should be obvious reasons.   As early as the 1970’s federal regulators realized that without some regulatory help, financial institutions would be used as tools for disposing of the cash received from crimes.  Criminals would simply deposit their money in the bank, wait a few days and then make legitimate withdrawals.   Once the cash was co-mingled with other deposits, there would be no way to tell which money came from real legitimate effort and which was the result of crime.   

Popular Schemes

Some of the more popular schemes for changing criminal cash into legitimate money include; 

 

·         Black Market Foreign Exchange:  In this enterprise, all of the participants are breaking one law or another.  On one end are importers of goods who do not want to pay the government rate for exchanging currency from US Dollars to the home currency (e.g. Peso’s).  These importers make a deal with a broker who is willing to import goods illegally.  The importer makes a deal with a criminal who has “dirty” US dollars.   The importer uses the “dirty” money to buy US goods and ships them to his own country.   The goods are then sold to the importers who pay the broker in local currency.  The criminal gets his money back in Pesos that are now “clean” 

·         Investing in Legitimate Businesses: Here a criminal buys all or part of a legitimate business and simply mixes his cash in with the earnings of that business.  This only works for business that already deal extensively in cash.  This is why gas stations, casinos, bars and check cashing stores are considered “high risk” for money laundering.  Because many professional service providers such as doctors and lawyers often take cash for payments, they are also considered “high risk”. 

·         Smurfing:  Sometimes a criminal will get a number of people working together to break up his cash deposits into small amounts.  This is called smurfing   

·         Structuring:  This is by far and away the most frequent form of attempted laundering.  Most people realize these days that a cash deposit above $10,000 has to be reported to the IRS.  Criminals have for years, tried to get around this limit by making deposits of smaller amounts on subsequent days. This is called structuring  

Over the years there have been many different schemes for trying to avoid detecting of money laundering.  In fact, there are simply too many to list here.  Suffice to say that there are criminal groups with nothing but money and time to try to figure out new and different ways to make “dirty” money clean.  

What is the Money Used For? 

There are many different uses for money once it has been laundered.  Some of the more onerous uses include:

 

·         Drug Dealing Activity

·         Human Trafficking

·         Terrorist financing

·         Tax evasion

·         Embezzlement

 

 As you can see, money that is laundered is used to fund extreme criminal enterprises.  This is why it critically important is that financial institutions do all that they can to lend a hand to legal authorities to stop money laundering. 

Each of the changes in BSA/AML laws were designed to improve the overall monitoring of cash and cash equivalent transactions.  For small financial institutions, the changes have been ongoing and significant.  As the regulations changed, the expectations of the regulatory bodies evolved.  Today, no self-respecting banker would consider operating without a full BSA/AML compliance program.   Moreover, very few banks can get away with a manual system for tracking and aggregating the transactions of their customers.   Today, a sound BSA/AML program includes software that helps bank staff aggregate and monitor transactions of its customers.  

 

 BSA/AML laws are really financial institution’s way of helping to keep the world a better, safer place.

---

[1] https://www.fincen.gov/news_room/aml_history.html  “History of Money Laundering Laws”