AML Enforcement: SEC Risk Alert & FFIEC Exam Manual Updates

Independent Testing

• Failure to conduct testing in a timely manner, or to demonstrate (via report, results, or other documentation) that testing had been conducted.
• Failure to address, or to have procedures for addressing, issues identified by independent testing in a timely manner.
• Independent tests that appeared to be ineffective due to:
  • Failure to cover aspects of the business or AML program.
  • Testing conducted by personnel that were not independent or did not have the appropriate level of knowledge or expertise.
  • Testing conducted under requirements not applicable to the securities industry.

Employee Training

• Failure to update training materials based on changes in the law.
• Failure to tailor training materials to the risks, products and services, and business activities of the BD.
• Failure to demonstrate that all appropriate personnel attended ongoing training, as well as inadequate procedures for following up with personnel who did not complete required training.

Inadequate CIPs, including failures to:

• Perform any CIP procedures as to investors in a private placement, where customer relationships established with BDs appeared to be formal relationships for purposes of the CIP Rule.

• Collect customers’ dates of birth, identification numbers, or addresses.

• Verify the identity of customers, including instances in which files indicated that verification was complete but required information was missing, incomplete, or invalid.

• Use exception reports to alert when a customer’s identity is not adequately verified in accordance with the CIP Rule.

• Accurately document aspects of CIP regarding review of alerts generated by third-party vendors to monitor for missing, inconsistent, or inaccurate information.

• Follow procedures of BDs’ own CIP, which included reviewing and documenting the resolution of discrepancies in customer information and conducting searches through third-party vendors.

• Failure to update AML programs or procedures to align with the CDD Rule

• Procedures that, in violation of the CDD Rule, permitted an entity to be listed as a beneficial owner without a corresponding requirement to obtain adequate information about beneficial owners of the entity.

• The opening of new accounts for legal entity customers without identifying all the legal entity’s beneficial owners, including where no beneficial ownership information was obtained, required information was missing, or no control person was identified.

• Failure to obtain documentation necessary to verify the identity of beneficial owners of legal entity customers, including by accepting expired government issued identification, or otherwise not performing such verification, or not documenting the resolution of discrepancies noted by firm personnel or a firm’s third-party identity verification vendor.

• Failure to follow internal procedures that required obtaining information about certain underlying parties acting through omnibus accounts.