NAFCU is also working the BSA issue from the regulatory side. "We've met with Treasury," NAFCU Senior Counsel and Director of Regulatory Affairs Carrie Hunt said. "We've also continued talking with NCUA and in part because of the new BSA manual and its reliance on risk assessments, there's a little bit of a 'wait and see' on the part of the agencies whether or not…relying on a risk assessment whether that's going to reduce the burden.

"As we know and we hear from our members, it takes quite some time to create a risk assessment and the yearly compliance with BSA still can be quite significant so it's still an issue for credit unions but there aren't necessarily new issues. They're still struggling with the existing ones."

Feelings were mixed as to whether credit unions were becoming more comfortable with BSA compliance after a couple of years of being put under a microscope. "They're not more comfortable because you have OFAC, you have SARs, you have the straight requirements of the Currency Transaction Reporting–all of those different things that come together and are confusing for everyone, not just credit unions," according to Dunn. And, it is not just small credit unions, she emphasized, "It runs the board."

Hunt added, "Software vendors are getting more up-to-speed in terms of what institutions need in terms of their BSA software but in terms of the actual burden for credit unions, depending on their level of risk, the reporting requirements can be quite significant. There's more of a comfort level with what the requirements are but in terms of the regulatory burden, that's not necessarily been reduced."

However, NCUA's Office of Examination and Insurance observed, "Many credit unions have adjusted to the increased attention paid to compliance issues, particularly relating to the BSA. An underlying common theme with these credit unions is educating our examiners on the process they have in place to mitigate risks. Since each credit union's compliance program needs to be tailored to their own unique risk profile, communicating their process to examiners is especially important." NCUA did note that while risk assessments are not required under BSA, they are essential to a solid compliance program and some credit unions still have not completed one. Dunn pointed out that there have been some credit unions cited for BSA violations, but nothing on the scale of a Riggs Bank or the recent Israel Discount Bank of New York. Violations can lead to reputational risk in addition to the actual financial penalties.

NAFCU, in the recent past, has questioned whether the product of all this work, which credit unions and other financial institutions are doing for their part in the war on terror and to combat money laundering, is leading somewhere. "FinCEN has indicated that they want to try to do a better job in letting the public know what the information is used for to the extent they can," Hunt acknowledged. "Obviously, a lot of the information, in terms of trying to stop crime, is going to be confidential. Certainly letting credit unions know what the information is used for can be helpful in the scheme of things but again that also doesn't reduce the regulatory burden. It's clear that financial institutions were asked to comply with BSA [for] crime fighting in this country but it's really just establishing the risk versus the benefits and those are some of the gray areas that we have concerns about." –[email protected]