The OCC Sets Out A Cogent Derisking Framework

Money Laundering

Best practice for risk management of foreign correspondent banks now has a newly defined protocol from the Office of the Comptroller of the Currency. The OCC and other U.S. regulators are now prepared to give heft to international policy priorities. The categorical derisking of correspondent banks, the bane of organizations such as the Financial Action Task Force and International Monetary Fund, is very difficult to imagine as part of the OCC's newly defined protocol.

Robert Axelrod

By Robert M. Axelrod

Robert M. Axelrod is a managing director in Deloitte Transactions and Business Analytics LLP, an affiliate of Deloitte Financial Advisory Services LLP. He specializes in projects addressing financial transactions in regulatory and compliance contexts, including anti-money laundering and antiterrorist financing, as well as anticorruption concerns in the financial services industry, specifically addressing banks, insurance companies, and broker dealers.

The Office of the Comptroller of the Currency's (OCC) Bulletin 2016-32 (Risk Management Guidance on Foreign Correspondent Banking), issued October 5, 2016, is by far the most cogent, coherent U.S. government protocol around the controversial derisking topic, to date. This article discusses what the bulletin does, what and how it appears to accomplish in terms of derisking, and what the implications are in this area going forward.

In General: The OCC bulletin sets out best practices for banks that are considering derisking their foreign correspondent banking accounts. It followed the views previously articulated in speeches from the OCC and the Financial Crimes Enforcement Network (FinCEN) and in recommendations by the Financial Action Task Force (FATF) and International Monetary Fund (IMF), among others, to discourage banks from categorically terminating these accounts in terms of their anti-money laundering (AML) risk. Similarly, these views sought to have banks consider alternatives to termination, including how they can reasonably keep the accounts open. These views are implemented in the bulletin by framing the termination decisions as risk decisions (non-risk based terminations are excluded from the Bulletin's scope), but including, as part of the consideration matrix, social policy issues, such as the prospect that a foreign jurisdiction will be underserved by financial markets, and something akin to fairness in the pace and communications process through which termination decisions occur. The implications are that the OCC (and presumably other U.S. regulators) are now prepared to give heft to the international policy priorities in derisking, and to remove what has heretofore been a U.S. laissez fair approach to banks that have sought to manage their AML risk, including regulatory risk, by culling, including casually culling, their high risk accounts. There is no reason to believe this approach will not extend to other account types that are the subject of derisking, and U.S. banks currently serving high risk accounts are less able today than they were a month ago to consider their own risk issues away from those of the broader market in termination decisions.

The derisking controversy itself has been actively pursued in articles and speeches. In brief, some U.S. banks appear to have responded with categorical termination to the risks of carrying high AML risk accounts, such as foreign correspondent banking, money services businesses, charities and individuals from high risk jurisdictions. That is, many or all of an account type has been eliminated by termination. From a policy point of view, this has had the potential effect of driving some business into the shadow banking world, where it effectively supports a financial market infrastructure that is less regulated and relatively inviting to the criminal element. The FATF and IMF have expressed concern about the prospect of denying “financial inclusion” to some market segments, and attempts to measure the extent of this impact have appeared from bodies such as Bank of International Settlements Committee on Markets and Payments Infrastructure, in June 2016. The concern has also been raised that causing problematic transactions to go into less regulated financial institutions makes the transactions more opaque to law enforcement and regulators, and thus increases system risk even if it might technically reduce risk to a particular bank.

These social policy issues may appear both valid and weighty, but they have not clearly been part of the (self-limited) risk calculation of a bank worried that by carrying a high risk account, it takes a high profile chance of an enforcement action. After all, any account can go awry and a high risk one going awry generally draws enhanced attention from regulators and prosecutors. The bigger enforcement actions in the last 15 years have perhaps made banks bearish in this regard. The frustration of regulators in attempting to advance these social policy issues by having them presumed into a bank's own risk management issues is exemplified by the view of one regulator that a bank eliminating a categorical set of accounts (such as charities) is presumptively doing so as part of an improper ethnic discrimination, anti-trust violation or the like, rather than making a candid risk analysis. Specifically, in February, 2016, the U.K.'s Financial Conduct Authority, after giving its thoughts on how banks should be careful in their derisking decisions and avoid categorical results, and suggesting that appropriate terminations would not be frequent, said, “As a result, we now consider during our anti-money laundering requirements work whether firms' derisking strategies could lead to consumer protection and or competition issues.” The bulletin now addresses this issue by announcing best practices standards around risk management.

What the Bulletin Does: Best practice for risk management of foreign correspondent banks now has a newly defined protocol, with differences from prior guidance concentrated on termination decisions. First, the bank needs to have a periodic review process around the risk of these relationships, apparently on a relationship by relationship basis, as to which it forms a view on whether to retain or terminate, and whether and how it can manage the risks presented. Second, it needs to advise senior management of termination decisions, and this advice includes how the proposed decisions will impact potential customers in a geographic location, and how the bank has thought through whether there are steps short of termination, such as limited business, that could have been taken. Third, unless contrary to law, it must both give the potentially terminated customers an opportunity to explain what they can do to mitigate the risk considerations, and to allow them a reasonable time to create alternative banking relationships. This includes letting the correspondent bank know when its activity has been outside expectations, presumably to gather a suitable explanation, change of expectation or promise of adherence to prior expectations. It also includes clarifying to the correspondent bank why it is being terminated, to avoid misunderstanding. The days of sending the letter which says, “Under our account agreement, we have always been able to terminate your bank at any time and for any reason, and that time has come.” seem to be dwindling, at least around AML risk. Finally, the bank should have a clear audit trail for all of these steps.

How the Bulletin Gets It Done: The bulletin makes categorical derisking of correspondent banks, the bane of FATF, the IMF and others, very difficult to imagine as occurring as part of the newly defined best practices. It frames the periodic risk review for these accounts around the AML risk clearly articulated in the due diligence provisions for foreign correspondent accounts in Section 312 of the USA Patriot Act and its implementing regulations. The closest pairing of bank risk with the social policy goals is the supposition in the bulletin that categorically derisking foreign correspondent banking accounts without explanation, tailoring and investigation of alternative methods of addressing AML risk, could result in reputational risk to the bank or even litigation. These prospects seem to have been singularly undaunting to date for the U.S. banks choosing to derisk accounts. Nonetheless, this is a putative direct risk to the bank whose management is consistent with the framework articulated in the bulletin. The Bulletin also requires the engaging of senior management in addressing (it must at least be informed) the social policy issues, and in effect encourages senior management to exercise its best efforts to salvage these relationships in one way or another. Finally, the requirement of an audit trail means that specific individuals at a bank will be highlighted in documentation as taking responsibility for the derisking decisions, a role that may not be taken on as lightly tomorrow as it was yesterday. While this role is nominally the same for retaining relationships as for terminating them, the greater scrutiny in the bulletin appears directed to termination.

Implications: For the derisking area, there are many other kinds of accounts besides foreign correspondent banking accounts, including, as mentioned above, charities and money services businesses. They are all subject to AML derisking because they in fact have been identified with enhanced money laundering and terrorist financing risks. It is difficult to imagine a distinction from correspondent banking that would make these other account types subject to different best practices in this regard, although the bulletin is silent here. Along these lines, it is useful to compare the approach to correspondent banking with that taken in the Federal Financial Institutions Examination Council/Bank Secrecy Act (FFIEC/BSA) Examination Manual for one of the earlier targets of derisking by U.S. banks, embassy accounts. Although not nearly as elaborate, the FFIEC Manual approach for embassy accounts addresses many of the same concerns about tailoring and management as the bulletin does for correspondent banking accounts, though in a much more precatory tone. In addition, the implication here is that in this context, social policy issues that are fairly framed in terms of national or global AML risk seem to gain relatively equal footing with AML risk that is specific to the bank in question. Financial inclusion may be seen as generally beneficial for law enforcement (by way of transparency) and for general economic well-being (for the clients with better access to banking services). However, prioritizing such concerns as part of the risk management decisions by an individual bank is an additional step now taken by the bulletin, although it is framed at this point only as a best practice rather than as a discrete regulation. The approach that may be taken to derisking going forward is thus changed substantially for correspondent banking, and probably for other areas as well.

Copyright © 2016 The Bureau of National Affairs, Inc. All Rights Reserved.