Board of Directors Accountability for BSA/AML Compliance Deficiencies
 
October 19, 2006
 
Timothy N. Bergan- Chicago
Janet Wagner- Chicago

Regulators are raising the bar for directors’ duty of care, thereby increasing directors’ fiduciary responsibility. This increased responsibility means increased accountability which could result in personal liability.

Directors have a duty of care to act: (1) to the best of their ability; (2) in good faith; and (3) in a manner reasonably believed to be in the best interests of the bank. Directors may rely on information and reports from officers and employees. However, such reliance must be based on a reasonable belief. The standard is whether directors know or should have known that the people providing the information and reports are competent, and that the reports and information are reliable.

Historically, banks and bank regulators worked together as partners with a common goal. That partnership has been strained by the substantial burdens to detect and deter terrorist financing schemes that have been imposed on banks and regulators, as well as the increased scrutiny of compliance and supervisory failures. Therefore, it is critical that directors establish strong and effective working relationships with the bank’s regulators to restore the partnership that has served the industry well.

Regulators’ Major Concerns

Overall, regulators are concerned that directors do not fully understand how critically important BSA/AML compliance is to regulators, Congress, investors and other stakeholders. Specific concerns include: (1) a lack of “tone at the top” creating a culture of compliance and the message it sends to employees; (2) inadequate assessment of the bank’s overall Bank Secrecy Act/Anti-Money Laundering (BSA/AML) compliance risk; (3) importance of audit coverage, reporting, and follow-up for BSA/AML compliance; and (4) inadequate resources devoted to BSA/AML compliance and training. These regulatory concerns create significant legal and reputational risks due to compliance deficiencies.

Consequences of Noncompliance

The cost of noncompliance is almost always far greater than the cost of fixing things beforehand. Regulators are not hesitant to impose formal and informal regulatory sanctions with potentially large civil monetary penalties. Even informal sanctions involve ongoing intensive and intrusive regulatory oversight which impose significant direct costs for forensic reviews, audits and frequent detailed reports to regulators.

Limits on expansion, whether by acquisition or branching, are highly probable consequences. Moreover, the damage to reputations – both the bank’s and directors’ – can be substantial and directly affect shareholder value.

Warning Signs for Directors No news may not be good news – directors must pay as much attention to what they don’t hear as to what they do hear. Some obvious red flags are a letter from regulators, subpoenas, inquiries from law enforcement, and repetitious or unresolved issues in examinations and audits. But attention to obvious warning signs is not enough. Directors must carefully review management reports, high risk account activity, cash and automated clearing house (ACH) transactions, unusual deposits, loan activity and reports, and wire transfer activity. Directors should focus on patterns and changes in the activities and operations, and, recognizing the director’s duty of care, ask whether the patterns or changes make business sense. Are they consistent with the bank’s strategic plan or related to specific business initiatives?

Protecting Yourself and the Bank

In the current regulatory environment, the directors’ dilemma is one of directing versus managing. The Board of Directors plays a critical role in the successful operations of the bank and is ultimately responsible for the conduct of the bank’s affairs and its compliance with laws and regulations. However, directors generally, and outside directors particularly, do not manage the bank. They need not be experts in finance, bank operations or banking laws and regulations, including BSA/AML.

Rather, outside directors should use their judgment honed by experience and success in business or other endeavors to develop strategic plans that include the board’s philosophy and vision of the future. To do so, directors must understand the business flowing through the bank and the sources of risks to the bank. Based on this understanding, the board must establish the risk tolerance acceptable for the bank and establish specific policies consistent with the strategic plan and risk tolerance.

Above all, directors must be engaged and proactive. The single most important act directors can perform is to hire competent management. With competent management as a foundation, directors must then ensure that the bank’s policies and procedures are implemented effectively with sufficient personnel and resources to monitor the bank’s activities on a continuous basis.

What’s the Point?

In short, directors should mind three Ps and one Q:

People:    Hire competent professionals.

Policies:    Ensure effective implementation.

Prevention:    Establish proactive partnership with your regulators.

Question:    Challenge management to ensure management faithfully implements the bank’s strategic plan as well as compliance policies and procedures.

For more information, e-mail Tim Bergan at tim.bergan@hklaw.com or Janet Wagner Jelen at janet.jelen@hklaw.com or call toll free, 1-888-688-8500.