Internal Controls and SAR Filing Decision
You are the head of compliance at a small community bank. The bank has a manual transaction monitoring system: staff are expected to review daily reports of cash transactions over $10,000 and flag any suspicious activity to the compliance officer. The compliance officer is also the bank's internal auditor and reports directly to the CEO, who is also the bank's largest shareholder. Recently, a teller noticed that a long-standing customer, a local restaurant owner, made multiple cash deposits totaling $60,000 over two weeks, each just under $10,000. The teller reported it to the branch manager, who told the teller to 'not worry about it' because the customer is well-known and the branch manager is friends with him. The compliance officer was not informed. The bank's policy requires all suspicious activity to be reported to the compliance officer, who then decides whether to file a SAR. The CEO has previously expressed concern that filing SARs might drive away business.
1. What internal control weaknesses are evident in this scenario?
Read the worked answer
Key weaknesses:
- Lack of independence: The compliance officer also serves as internal auditor and reports to the CEO, who is the largest shareholder. This compromises independence and creates a conflict of interest.
- Inadequate reporting culture: The branch manager dismissed the teller's report without escalation, violating policy. This suggests a culture that discourages reporting and may be influenced by personal relationships.
- Manual monitoring limitations: The manual system relies on staff vigilance; the branch manager's intervention shows it can be bypassed.
- CEO's stance: The CEO's concern about losing business may create pressure not to file SARs, undermining the compliance function.
- No segregation of duties: The compliance officer's dual role as auditor reduces checks and balances.
- Lack of whistleblower protection: The teller's report was not properly handled, and there is no indication of a mechanism to report concerns anonymously.
2. What should the compliance officer do upon learning of this situation, and how should the bank address the control weaknesses?
Read the worked answer
Upon learning, the compliance officer should:
- Immediately investigate the cash deposits and the branch manager's actions.
- File a SAR if suspicion is confirmed, regardless of the CEO's concerns. The compliance officer has a legal obligation to report suspicious activity.
- Document the investigation and the decision.
- Report the branch manager's misconduct to senior management and HR for disciplinary action. To address control weaknesses:
- Separate the compliance and internal audit functions to ensure independence.
- Establish a direct reporting line for the compliance officer to the board or a board committee, not the CEO.
- Implement a whistleblower policy with anonymous reporting channels and protection.
- Enhance monitoring systems to be more automated and less reliant on manual reporting.
- Provide training to all staff on AML/CTF obligations and the importance of escalation.
- Foster a culture of compliance from the top, with the CEO and board setting the tone.
- Regular independent audits of the AML program.