MSB Customer, SAR Backlog, and a Board That Deferred Remediation
Lakeshore Community Bank ($2.9 billion assets) banks QuickCash, a money services business (MSB) that transmits $180 million a year through 2,100 agents in 14 states. The bank's transaction monitoring system generates about 3,100 alerts per month. Six analysts handle them; 45% of alerts are older than 60 days, and the average time from alert closure to SAR filing is 52 days. QuickCash's CDD file is three years old and lacks an updated agent list, ownership chart, and source-of-funds analysis. Seventeen percent of the bank's legal entity customers have no beneficial ownership certification. The bank also maintains a correspondent account for a foreign bank with $40 million in annual throughput. An independent test identified 'significant deficiencies,' but the board minutes say remediation will wait until after a core conversion. The regulator has scheduled a targeted AML examination in 90 days. The CEO asks whether the bank can keep QuickCash and what must happen first.
1. Assess the bank's AML program against the core pillars and rank the deficiencies by supervisory severity.
Read the worked answer
The core pillars are internal controls, customer due diligence, suspicious activity reporting, independent testing, and training. The most severe deficiency is the SAR and monitoring breakdown: 3,100 alerts per month with six analysts, 45% older than 60 days, and a 52-day average from alert closure to filing. That means alerts may sit for 60 days and then take another 52 days to file, far beyond the 30-day standard from initial detection. Next is CDD: the QuickCash file is stale, lacks an agent list, ownership chart, and source-of-funds analysis, and 17% of legal entity customers lack beneficial ownership certification. Third is governance: independent testing found significant deficiencies, but the board deferred remediation for a core conversion. Fourth is training and foreign correspondent due diligence.
The ranking matters because SAR and CDD failures are direct, examinable violations that can support enforcement action, while training gaps are usually remediable through program changes. The MSB and foreign correspondent relationships are high-risk and require enhanced due diligence, not standard monitoring.
2. Explain the SAR timing rules and whether the 52-day average is acceptable. What should management do about the backlog?
Read the worked answer
A SAR generally must be filed within 30 calendar days after initial detection of facts that constitute a reasonable suspicion of a reportable activity; the period may be extended to 60 days if no suspect is identified. The clock starts at detection, not at alert closure. If an alert sits in the queue for 60 days and then takes 52 days to file, the bank is filing about 112 days after detection. The 52-day average is therefore not acceptable, and the backlog itself is a supervisory violation even if individual filings are eventually made.
Management should triage the backlog by risk and age, assign senior investigators, document no-SAR decisions, file late SARs for reportable activity, and conduct a lookback of at least 12 months. It should add temporary analysts and quality-control review, and only tune monitoring rules after the backlog is under control so that tuning does not suppress needed alerts. The board should receive weekly metrics. SAR confidentiality must be preserved, and all decisions should be documented.
3. Should the bank retain QuickCash? Set out a 90-day remediation plan and the board's role.
Read the worked answer
The bank may retain QuickCash only if it can apply enhanced due diligence commensurate with the risk: current ownership and agent lists, source-of-funds analysis, agent site visits, transaction limits, periodic re-underwriting, and monitoring tailored to MSB flows. If that cannot be achieved before the examination, the bank should restrict or exit the relationship.
A 90-day plan should: immediately complete a risk assessment and suspend new agent onboarding; update CDD and beneficial ownership files; clear the SAR backlog and file late SARs; validate monitoring and staffing; complete independent testing follow-up; train staff; and report metrics to the board. The foreign correspondent account should also receive enhanced due diligence or exit consideration. The board must approve the plan, record it in minutes, and monitor progress; a core conversion is not an acceptable reason to defer remediation. If deficiencies persist, exiting QuickCash and the foreign correspondent is the safer supervisory outcome.