Federal anti-money laundering (AML) regulations, rooted in the Bank Secrecy Act (BSA), have long required financial institutions to maintain internal control systems to assure compliance, provide for independent testing, designate individuals responsible for compliance and provide training for all appropriate personnel. Building beyond the federal BSA/AML framework, the New York State Department of Financial Services (DFS), led by newly appointed Superintendent Maria Vullo, has issued regulations – effective January 1, 2017 – that dictate specific features for transaction monitoring and filtering programs and require annual board or senior officer certification of compliance. In tying its mandate for transaction monitoring and filtering programs to BSA/AML standards, DFS may be telegraphing a tacit intent to induce federal and other state regulators to pursue a similar approach. Accordingly, uncovered institutions might consider treating the new regulations as a potential safe harbor and adapt their compliance practices. 

Specifically, the new regulations cover New York-chartered banks; trust companies; private bankers; savings banks and savings and loan associations; New York-licensed branches and agencies of foreign banking corporations and New York-licensed check cashers and money transmitters (“Regulated Institutions”). At their core is a mandate for each Regulated Institution to perform a comprehensive enterprise-wide BSA/AML risk assessment tailored to its size, staffing, governance, businesses, services, products, operations, customers, counterparties and other relations and their locations, as well as the geographies in which it conducts its business. 

Under the new regulations, a Regulated Institution must devise and maintain both a Transaction Monitoring Program and a Filtering Program based on its risk assessment and reasonably designed to comply with risk-based safeguards. The purpose of the Transaction Monitoring Program is to monitor transactions after their execution for potential BSA/AML violations and reporting of suspicious activities, while the purpose of the Filtering Program is to interdict transactions that are prohibited by the federal Office of Foreign Assets Control (OFAC). Standards are enumerated for these programs, including periodic review and updating, multi-stage testing, alert processing protocols, adequate funding, management oversight and engagement of qualified personnel or outside consultants. 

In the wake of intense controversy, DFS has adopted a somewhat more flexible certification requirement than the one originally proposed. Beginning April 15, 2018, and on each April 15th thereafter, every Regulated Institution is required to submit a prescribed form containing a board resolution or senior officer compliance finding attesting that, to the best of their knowledge based on their thorough review, the transaction monitoring and filtering programs comply with the provisions of the new regulations. 

Even more concerning from a competitive standpoint, by increasing administrative burden and casting boards and senior compliance officers as quasi-guarantors of BSA/AML compliance, the new regulations would appear to put DFS-supervised institutions at a distinct disadvantage to uncovered New York financial institutions like national banks, federal savings associations and Federal branches of foreign banks. 

Deserving of the highest priority is the special challenge Regulated Institutions face as they begin to determine how to manage costs and avoid duplicative effort in complying with DFS regulations, BSA regulations and, in many cases, Sarbanes-Oxley internal control certifications. To support the certification process, as the new regulations suggest, Regulated Institutions can benefit from advice of experienced legal counsel and consultants. These experts will be invaluable in mapping an overall control framework that encompasses structuring of risk assessment, apportionment of internal duties, design of effective testing mechanisms and development of relevant training modules, as well as preservation of a reliable audit trail.

Walter Donaldson, FGIS, is co-author of this article.