<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

Sharing BSA Resources with Another Institution? Third-Party Vendor Management Rules Apply

author Michael Berman
1 min read
Oct 9, 2018

Regulators have given financial institutions a green light for sharing Bank Secrecy Act (BSA) resources in some situations, but proper third-party vendor management practices and controls must be in place, according to a new interagency statement.

The Federal Reserve, Federal Deposit Insurance Corporation (FDIC), National Credit Union Administration (NCUA), Office of the Comptroller of the Currency (OCC), and the Financial Crimes Enforcement Network (FinCEN) clarified their position on collaboration, noting it was most appropriate for simpler, community-focused institutions with a lower risk for money laundering (AML) or terrorist financing.

For example, an institution may find it effective to borrow someone well versed in BSA/AML from another institution to conduct independent testing or combine forces to make it more cost effective to hire a BSA/AML trainer. Sharing a compliance officer is far more challenging and less likely to work, the statement says.

Collaborating & Vendor Management

Financial institutions should treat their BSA collaborators as third-party vendors subject to all vendor management guidance. The statement specifically mentions:

Contracts. A written agreement should define:

  • the nature and type of resources to be shared.
  • each institution’s rights and responsibilities.
  • procedures for protecting customer data and other confidential information.

Risk management. Develop a framework to manage the risks of sharing resources. This includes due diligence and a full risk assessment.

Performance review. This should be reviewed by management and periodically evaluated.

Ongoing monitoring. There should be systems and resources to ensure bank management properly oversees shared resource activities.

Reporting. Senior management and the board should be given and review periodic reports about the relationship.

The Takeaway

If you’re sharing BSA/AML resources with another institution, don’t treat it as a casual exchange. Your partner is a de facto vendor. Thorough vendor management is a must.

 

Related: Vendor Risk Countdown: Top 10 Risks Third-Party Vendors Pose to Your Financial Institution

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Nrisk Regulatory Compliance Management News & Updates HMDA Risk Mortgage Lenders Ncomply Vendor Management Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Third-Party Vendor Management Business Continuity Cybersecurity Fintech NVendor Strategic Planning Ncyber Ntransmittal Audits & Findings Company Culture OCC Regulatory Updates Audit Nverify Regulatory Compliance Exams FDIC Compliance Management Findings Nfindings NCUA Contract Management Employee Intranet Contract FRB Business Continuity Management FFIEC Findings Management Ncontracts manager Third-Party Vendors Vendor Risk Enterprise Risk Management ABA Bank Access Control Audit Findings Board Portal Call Report Due Diligence Efficiency Employee Engagement Exam findings FIEC Inc. 5000 Internal Audit Management Nboardportal Verify Wealth Management
Did Your Vendor Need PPP Funds?
Banks

Did Your Vendor Need PPP Funds?

Jul 14, 2020 3 min read
First, Second, Third, Fourth and Fifth Parties: How to Measure the Tiers of Risk
Risk Management

First, Second, Third, Fourth and Fifth Parties: How to Measure the Tiers of Risk

Jun 12, 2018 4 min read
A Model CIO: Equifax CIO Keeps Showing Us How *Not* to Respond to a Breach
Banks

A Model CIO: Equifax CIO Keeps Showing Us How *Not* to Respond to a Breach

Jul 30, 2019 3 min read