Compliance Update with Amy K

​BSA/AML Exam Manual Updates; NCUA continues to warn of increasing cyberattacks; and a reminder of the many compliance solutions you can utilize through DakCU.
 

FFIEC BSA/AML Exam Manual Updates
The Federal Financial Institutions Examination Council (FFIEC), which is a formal interagency body empowered to prescribe uniform principles, standards, and report forms for the federal examination of financial institutions. The council also makes recommendations to promote uniformity in the supervision of financial institutions. NCUA is a member of the FFIEC.

The FFIEC recently issued updates to its BSA/AML Exam Manual, which covered three revised sections and three new sections. There were no changes to the regulatory requirements covered by these sections. The agencies made revisions to ensure language clearly distinguishes between mandatory regulatory requirements and considerations set forth in guidance or supervisory expectations.

The revised sections are: 

• Special Information Sharing Procedures to Deter Money Laundering and Terrorist Activity;
• Due Diligence Programs for Correspondent Accounts for Foreign Financial Institutions; and
• Due Diligence Programs for Private Banking Accounts.

New sections to the manual are:

• Prohibition on Correspondent Accounts for Foreign Shell Banks; Records Concerning Owners of Foreign Banks and Agents for Service of Legal Process;
• Summons or Subpoena of Foreign Bank Records; Termination of Correspondent Relationship; Records Concerning Owners of Foreign Banks and Agents for Service of Legal Process; and
• Reporting Obligations on Foreign Bank Relationships with Iranian-Linked Financial Institutions.

 
NCUA Express – Increase in Cyberattacks
The National Credit Union Administration (NCUA) issued a NCUA Express notice after observing a recent uptick in cyberattacks against credit unions, credit union service organizations, and third-party service providers. As explained in the notice, “these attacks include incidents directly related to critical vulnerabilities in the MOVEit Transfer web application, as well as other attacks unrelated to MOVEit. The critical vulnerabilities in the MOVEit Transfer web application are:

• CVE-2023-34362;
• CVE-2023-35036; and
• CVE-2023-35708.”

The NCUA Express notice includes several recommendations from the NCUA, along with mitigation steps and best practices to safeguard against these evolving cyber threats. Please review the notice carefully that was pushed out from the NCUA on August 3, 2023. To highlight a few of the recommendations from the NCUA –

• Patch and Update MOVEit Transfer Web Application.
• Implement multi-factor authentication for all sensitive accounts and systems, including email accounts and remote access portals.
• Conduct regular cybersecurity training for all employees.
• Deploy advanced email security solutions with phishing detection and blocking capabilities. Utilize Slender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Authentication, Reporting, and Conformance (DMARC) protocols to prevent email spoofing and enhance email authenticity.
• Develop and regularly test an incident response plan.
• Review and assess the cybersecurity practices of all third-party vendors that provide financial services and products, including CUSOs. Verify that vendors use sound risk management principles, have robust security measures in place, and review their security posture regularly.
• Implement network segmentation to contain the impact of a potential compromise.
• Maintain frequent data backups and test the data recovery process regularly.
• Participate in threat intelligence sharing communities to stay informed about emerging threats and attack trends.
• Monitor network traffic, logs, and systems continuously to detect and respond promptly to any suspicious activities.

NCUA concludes, if you require further assistance or have any questions related to cybersecurity, please contact your Regional Office or visit the NCUA’s Cybersecurity Resource Center.
 
Compliance Solutions
The Dakota Credit Union Association assists member credit unions in finding cost-effective solutions to help
reduce regulatory and compliance burdens. Contact Amy Kleinschmit with questions on any of these solutions at
701-250-3964.

InfoSight provides immediate access to current compliance topics​ which explain: What is the issue (in laymen’s terms)​; How it affects credit unions​; What credit unions need to do — the action steps needed​. InfoSight also provides helpful tools, such as frequently asked questions and checklists.  This is NOT just for the Compliance Officer! Compliance touches every area of the CU and InfoSight can provide information for front line staff, HR, Loan Officer, Board & Volunteers, Executive Staff, Marketing, Collections, and more. InfoSight is provided as a due supported benefit of membership to affiliated credit unions.

CU PolicyPro is an online policy manual providing more than 230 complete operation model policies for credit unions. Full policy management system allows credit unions to edit, store, audit, distribute, and archive policies. Assignments, alerts and reminders help credit unions keep their policies up to date as regulations change over time. CU PolicyPro is also provided free as a benefit of membership for affiliated credit unions.

Custom Performance Reports are provided bi-annually as a benefit of your DakCU membership. The reports highlight and measure many areas of performance, including loans, shares, fee and other income, capital analysis, and liquidity trends, just to name a few.  The analysis helps credit unions assess their performance levels by comparing this year’s results with previous results, by comparing trends in relation to your peer group or other benchmark, and by graphical information that provide additional insight into your credit union.

RecoveryPro Disaster Planning Manual provides an organized approach to developing your business continuity plan. From identifying potential risks to creating emergency procedures to documenting procedures for restoring key technologies and services for your credit unions, RecoveryPro will guide you through it all. Learn more about this product, including pricing, here.

AffirmX Compliance Monitoring is the industry-leading compliance solution, providing credit unions with a palette of service offerings that systemizes checks and balances and is essential for safety and soundness. As part of the AffirmX advantage, our panel of compliance experts conducts a thorough analysis behind the scenes by examining internal and external factors, taking your compliance to the next level based on risk. AffirmX’s patented technology together with our risk-intelligence analysts will deliver the solution your credit union needs, for far less than the traditional audit and review service.

By combining user-friendly workflows with expert analysis and a risk-based dashboard, AffirmX helps your team stay ahead of compliance issues covering core functional areas of your credit union including: Advertising/Marketing, BSA, Compliance Management, Deposits, Lending (Consumer and Real Estate) and Operations.

In addition to the Compliance Monitoring solution, AffirmX offers a suite of solutions including Fair Lending Assessments; Loan File Reviews and Internal Audit Outsourcing – just to name a few.

BSA/ACH/Website and SAFE Act audit package. Experience how easily AffirmX can help reduce risk management workloads, anxieties and costs with our Four Report Package, each of which is critical to a healthy compliance program: BSA Independent Audit Annual ACH Independent Audit; Annual SAFE Act Independent Audit; Website Compliance Review (any audit may be omitted with a price reduction).

PayLynxs is an easy-to-use, affordable compliance automation software service for AML, BSA and Watch List scanning.  The software comes with out-of-the-box default settings in place so that you can start using PayLynxs immediately.  PayLynxs is pre-integrated with most major core data processors to receive overnight batch files.

Credit Union Compliance Management System™ (CU CMS) is specifically designed for credit unions to streamline the entire regulatory compliance process. It’s your newest DakCU member benefit. CU CMS is an intuitive, scalable compliance solution that includes timely regulation alerts, guided workflows and an advertising review tool, as well as a federal and state law and regulation library, evidence tracking, RISK alerts from CUNA Mutual Group and an easy-to-use dashboard.