Compliance Blog

NAFCU has updated its book of answers.  It is now 88-pages in length.  NAFCU members can access it here.  (Log-in information needed.)

For you non-NAFCUers, here's a taste.

Question:   How often should our credit union review our Bank Secrecy Act (BSA) risk assessment?

Answer:  The FFIEC BSA/AML Examination Manual indicates that a risk assessment should be an ongoing process and not just a one-time exercise. An effective BSA/AML compliance program controls risks associated with a credit union’s products, services, members, entities and geographic locations.  See pages 24-25 of the FFIEC BSA/AML Examination Manual (August 24, 2007.) A credit union’s management should update its risk assessment any time there are changes in the credit union’s risk profile. Some examples of changes impacting a credit union’s risk profile would be the introduction of new products and services and changes to existing products and services.  Id. However, the BSA/AML Examination Manual makes it clear that even if there are no changes, credit unions should reassess their BSA/AML risks at least every 12 to 18 months. Id.