Like every other important function in a financial entity, a BSA/AML compliance program cannot be expected to operate on autopilot. Managers and employees have to be aware of their responsibilities in the compliance program, and contribute actively as needed. Appropriate training is necessary to transform a compliance program design into an effective on-going operation.
The content and depth of training protocols will vary depending on the size, type, complexity, and risk profile of the organization. However, the Bank Secrecy Act and related laws require that covered organizations have the ability to implement business-specific anti-money laundering programs to help enforce the laws. Broadly speaking, the training program that will enable the organization to do this has five elements.
1. The Board of Directors and Senior Management have to maintain oversight.
As part of a “culture of compliance,” top managers have to be fully informed about the policy issues involved in BSA regulations and authorize the resources needed to comply. They should periodically monitor and evaluate the compliance program based on a risk adjusted evaluation (audit) as well as reports on internal controls. Ultimately, the organizational risk due to money laundering needs to be fully understood at this level, both with respect to the consequences of the crime as well as of non-compliance.
2. The organization should designate a BSA/AML Compliance Officer.
The Board and top management may not be directly responsible for knowing the details of compliance, but the Compliance Officer should be. This position needs to be trained to understand the BSA in detail, understand what compliance means for his or her organization, take a lead role in developing a concrete compliance program, and be responsible for its implementation. This person’s training needs to be routinely updated to make sure changes in the regulations are known and acted upon as needed.
3. Affected employees should be trained as needed.
Not every employee needs to understand every aspect of the organization’s compliance program. But they do need to be aware of and act on responsibilities that fulfill the requirements of the Bank Secrecy Act (BSA) as it applies to their functional role. These roles might include setting up the overall compliance program, designing or implementing systems that can flag reportable transactions, monitoring systems for suspicious activity, conducting due diligence on customers, reporting transactions as needed, or auditing performance, among other functions. Again, training should be reviewed and updated, including if the employee’s functions change.
4. Training should include real world examples.
Since every covered financial business will be exposed to different kinds of risks, it helps intensify training to run “table top exercises” or simulations in what the risks may look like and how to react to them. Trainees will benefit from experiencing these hypothetical events, making it much more likely they will respond appropriately when confronted by suspicious activity in the real world.
5. Training documentation is part of the compliance program.
Simply put, BSA enforcement can include a review of the training protocols. Training indicates the seriousness of the organization’s program, and identifies whether its risk assessment and risk profile have been adequately translated into operations.
The ultimate point of training is not simply to establish compliance. It is to establish an effective anti-money laundering program. Failure to do this might be revealed in enforcement actions that can involve high fines.