Riggs Bank in Washington, D.C. was recently fined $25 millionfor Bank Secrecy Act (BSA) violations. This is the largest penaltyever for BSA violations. In the recent past, NCUA has issued aCease and Desist order to correct deficiencies in a credit union'sBSA program and placed another credit union in conservatorship formultiple BSA violations. In 2003, NCUA issued a Letter ofUnderstanding to a credit union for numerous violations of BSA anda letter to another credit union for failing to have a BSA program.Are these isolated instances or do they indicate a trend towardscloser scrutiny for BSA compliance? Every indication is that theseare not isolated but rather a clear harbinger of things to come.Your credit union will be subject to closer scrutiny for BSAcompliance. If you are found out of compliance in certain keyareas, substantial penalties could very well ensue. Lets start withRiggs Bank. The $25 million dollar penalty is enormous. Riggs Bankbegan violating BSA way back in 1999. The Office of the Comptrollerof the Currency (OCC) detected violations but apparently did notimpose tough enough sanctions. As a result, Riggs Bank continued tocommit numerous BSA violations including failing to file suspiciousactivity reports on questionable transactions. The OCC finallyissued filed a consent order against the bank in July 2003. JoAnnJohnson, NCUA Chairman, was recently invited by the Senate BankingCommittee to testify on the NCUA's enforcement of BSA. Shecharacterized credit unions as having a good record of BSAcompliance. According to Johnson's testimony, officials in smallercredit unions and single common bond credit unions often have amore intimate understanding of their members' transactions, whichfacilitates their compliance with the requirements of the BSA.Consequently, she noted that money laundering has not been a majorproblem for credit unions. Could it ever be? There are those thatmight question whether a "small" credit union can have an intimateenough understanding of every member's transactions to adequatelydetect money laundering or suspicious transactions. An argument canbe made that even small credit unions need to have proper BankSecrecy Act and anti-money laundering programs or else run the riskof BSA violations. Just because a credit union is small, that doesnot mean that they necessarily know all of their members wellenough to detect money laundering or suspicious transactions. Smallcredit unions and larger ones alike must have sufficient BSA andAnti-Money laundering policies and procedures. With Congressfeeling that the regulators are not giving enough priority toanti-money laundering enforcement, regulators including NCUA areunder pressure to conduct more thorough BSA examinations. Morethorough BSA examinations mean more violations detected andpotentially more penalties assessed. What can you do to prepare?Have a BSA program. The first item examiners ask for is your BSAcompliance program. If you cannot produce this, a red flagimmediately goes up. If you do not have a BSA program, as requiredby NCUA Rules and Regulations, then how are you going to complywith the Currency Transaction Report and Suspicious Activity Reportreporting requirements? Not having a BSA compliance program almostinvites examiners to dig deeper. The BSA compliance program must bewritten, approved by the board of directors, provide for a systemof internal controls to assure ongoing compliance, provide forindependent testing for compliance to be conducted by credit unionpersonnel or outside parties, designate an individual responsiblefor coordinating and monitoring day-to-day compliance and providetraining for appropriate personnel. Next, you must have a system inplace to file Currency Transaction Reports. A Currency TransactionReport is required on all currency transactions that are over$10,000, including multiples totaling more than $10,000 andtransactions made by different individuals for the same accountholder. This is black and white with no grey. Grey? If you wantgrey, look no further than Suspicious Activity Reports (SARs). SARsmust be filed if you spot a crime or suspected crime and certainthreshold amounts are met. Crime or suspected crime means anytransaction involving funds derived from illegal activity, attemptsto evade any requirements under the Bank Secrecy Act, or atransaction with no apparent business or lawful purpose or is notthe sort of transaction in which the particular member wouldnormally be expected to be engaged in. So, if you think atransaction is suspicious, you are to file an SAR. Unlike aCurrency Transaction Report, this is not as clear-cut as it wouldseem. What you think is not suspicious may be considered suspiciousby someone else, like an examiner. No area of BSA is receiving moreattention today than SARs. Every employee of the credit unionshould understand the necessity of filing SARs. Assume for a momentthat the threshold filing amounts are met. An employee terminatedfor suspected theft? File a SAR. Member attempts identity theft viayour web site? File an SAR. Member possibly structuring cashtransactions to evade the Currency Transaction Reportingrequirements? File an SAR. Many of the recent regulatory actionsfor BSA violations centered on inadequate procedures for filingSARs. There is no magic number as to how many SARs your creditunion must file per year? However, if your credit union is $200million in assets and you have not filed any SARs in the last twoyears, it would make me take pause. It would be hard to believethat no attempted identity theft or no suspected monetarystructuring took place over the last two years. I would want tolook closely at your BSA program. To your chagrin, so would anexaminer. There are other requirements in BSA, including numerousrecordkeeping requirements. This article only highlights a few. Themost important thing is to recognize the potential liability forBSA violations and understand that examiners will be focusing moreattention on BSA program. Your response to this should be ensuringyou have a BSA program, a BSA officer, staff training, and a soundsystem in place to file CTRs, SARs and appropriate recordkeeping.Do not make the mistake of doing nothing. The cost for doingnothing could be $25 million.