establish a customer due diligence (CDD) program

[chadwhitacre]

Reticketed from #119. Depends on https://github.com/gratipay/gratipay.com/issues/3289.

[chadwhitacre]

The cornerstone of a strong BSA/AML compliance program is the adoption and implementation of comprehensive CDD policies, procedures, and processes for all customers, particularly those that present a higher risk for money laundering and terrorist financing.

http://www.ffiec.gov/bsa_aml_infobase/pages_manual/OLM_013.htm

[chadwhitacre]

The objective of CDD should be to enable the bank to predict with relative certainty the types of transactions in which a customer is likely to engage. These processes assist the bank in determining when transactions are potentially suspicious. The concept of CDD begins with verifying the customer’s identity and assessing the risks associated with that customer. Processes should also include enhanced CDD for higher-risk customers and ongoing due diligence of the customer base.

[chadwhitacre]

The concept of CDD begins with verifying the customer’s identity and assessing the risks associated with that customer.

Overlaps with https://github.com/gratipay/gratipay.com/issues/3289, then.

[chadwhitacre]

[...] and to report suspicious activity.

We're going to have to think through how we're going to relate to suspicious activity reporting (SAR) requirements.

[chadwhitacre]

Like, are SAR requirements intelligible for us since we're a processor and not actually a financial institution?

[chadwhitacre]

Much of the CDD information can be confirmed through an information-reporting agency, banking references (for larger accounts), correspondence and telephone conversations with the customer, and visits to the customer’s place of business. Additional steps may include obtaining third-party references or researching public information (e.g., on the Internet or commercial databases).

[chadwhitacre]

Guidance for identifying higher-risk customers may be found in the core overview section, "BSA/AML Risk Assessment," page 18.

[chadwhitacre]

Much thinner section of the manual compared to CIP (https://github.com/gratipay/gratipay.com/issues/3289).

Hah! You know what we're doing here? RingTFM! :blue_book: :dancer:

[chadwhitacre]

The first step of the risk assessment process is to identify the specific products, services, customers, entities, and geographic locations unique to the bank. Although attempts to launder money, finance terrorism, or conduct other illegal activities through a bank can emanate from many different sources, certain products, services, customers, entities, and geographic locations may be more vulnerable or have been historically abused by money launderers and criminals.

http://www.ffiec.gov/bsa_aml_infobase/pages_manual/OLM_005.htm

[chadwhitacre]

Geographic Locations

Identifying geographic locations that may pose a higher risk is essential to a bank’s BSA/AML compliance program. U.S. banks should understand and evaluate the specific risks associated with doing business in, opening accounts for customers from, or facilitating transactions involving certain geographic locations. However, geographic risk alone does not necessarily determine a customer’s or transaction’s risk level, either positively or negatively.

Higher-risk geographic locations can be either international or domestic. International higher-risk geographic locations generally include:

• Countries subject to OFAC sanctions, including state sponsors of terrorism.²²
• Countries identified as supporting international terrorism under section 6(j) of the Export Administration Act of 1979, as determined by the Secretary of State.²³
• Jurisdictions determined to be “of primary money laundering concern” by the Secretary of the Treasury, and jurisdictions subject to special measures imposed by the Secretary of the Treasury, through FinCEN, pursuant to section 311 of the USA PATRIOT Act.²⁴
• Jurisdictions or countries monitored for deficiencies in their regimes to combat money laundering and terrorist financingidentified as non-cooperative by international entities such as the Financial Action Task Force on Money Laundering (FATF).
• Major money laundering countries and jurisdictions identified in the U.S. Department of State’s annual International Narcotics Control Strategy Report (INCSR), in particular, countries which are identified as jurisdictions of primary concern.²⁵
• Offshore financial centers (OFC).²⁶
• Other countries identified by the bank as higher-risk because of its prior experiences or other factors (e.g., legal considerations, or allegations of official corruption).²⁷
• Domestic higher-risk geographic locations may include, but are not limited to, banking offices doing business within, or having customers located within, a U.S. government–designated higher-risk geographic location. Domestic higher-risk geographic locations include:
• High Intensity Drug Trafficking Areas (HIDTA).²⁸
• High Intensity Financial Crime Areas (HIFCA).²⁹

---

²² A list of such countries, jurisdictions, and governments is available on the OFAC Web site.

²³ A list of the countries supporting international terrorism appears in the U.S. Department of State's annual Country Reports on Terrorism. This report is available on the U.S. Department of State Web site.

²⁴ Notices of proposed rulemaking and final rules accompanying the determination "of primary money laundering concern," and imposition of a special measure (or measures) pursuant to section 311 of the USA PATRIOT Act are available on the FinCEN Web site.

²⁵ The INCSR, including the lists of high-risk money laundering countries and jurisdictions, may be accessed on the U.S. Department of State's Bureau of International Narcotics and Law Enforcement Affairs Web site.

²⁶ OFCs offer a variety of financial products and services. For additional information, including assessments of OFCs, refer to the International Monetary Fund's OFC page.

²⁷ The Basel Anti-Money Laundering (AML) Index is an additional resource that may be useful in assisting banks to evaluate geographic locations. The Basel AML Index is a composite index that evaluates indicators from various publicly available sources such as the FATF, World Bank, Transparency International and World Economic Forum.

²⁸ The Anti-Drug Abuse Act of 1988 and The Office of National Drug Control Policy (ONDCP) Reauthorization Act of 1998 authorized the Director of ONDCP to designate areas within the United States that exhibit serious drug trafficking problems and harmfully impact other areas of the country as HIDTAs. The HIDTA Program provides additional federal resources to those areas to help eliminate or reduce drug trafficking and its harmful consequences. A listing of these areas can be found at the White House's Office of National Drug Control Policy Web site.

²⁹ HIFCAs were first announced in the 1999 National Money Laundering Strategy and were conceived in the Money Laundering and Financial Crimes Strategy Act of 1998 as a means of concentrating law enforcement efforts at the federal, state, and local levels in high intensity money laundering zones. A listing of these areas can be found at the FinCEN Web site.