Letter concludes that a national bank’s proposal to streamline the filing of suspicious activity reports by automating the process for identifying and reporting potential structuring activity is consistent with 12 CFR 21.11 and 12 CFR21.21 (09/27/2019)

Interpretive Letter #1166

September 27, 2019 October 2019

12 CFR 21.11

12 CFR 21.21

Subject: Request for interpretive letter to streamline SARs for potential structuring activity

Dear [ ]:

I am writing in response to your letter dated February 22, 2019, addressed to my colleague,

[ ], on behalf of [ Bank ], (“request letter”) regarding a proposal to

streamline the filing of suspicious activity reports (“SARs”) by automating the process for

identifying and reporting potential structuring activity (“Structuring SARs”). Your letter asked

whether the Bank’s proposed streamlined process is consistent with the Office of the

Comptroller of the Currency (“OCC”) SAR regulation.1 The letter noted that the Bank also

requested the Financial Crimes Enforcement Network’s (“FinCEN”) issue an administrative

ruling or grant exemptive relief from its SAR reporting requirements for the proposed process.2

The proposal outlined in your letter raises several issues under the OCC’s regulations. First, you

seek an opinion regarding whether the proposed automated generation of SAR narratives is

consistent with the OCC’s SAR regulation. Second, you seek an opinion regarding whether the

OCC’s SAR regulation permits a bank to file a Structuring SAR based solely on an alert, without

performing a manual investigation, and, if so, under what circumstances. Third, your request

raises the question of whether the proposed automation of SAR filings is consistent with the

OCC’s BSA/AML Compliance Program regulation.3 Finally, you requested regulatory relief to

conduct the proposal within a “regulatory sandbox,” which would include a waiver of certain

regulatory actions by the OCC.

As explained further below, we conclude that the proposed automated generation of a SAR

narrative is consistent with 12 C.F.R. § 21.11(c)

of SAR filings is consistent with the

OCC’s BSA/AML Compliance Program regulation.3 Finally, you requested regulatory relief to

conduct the proposal within a “regulatory sandbox,” which would include a waiver of certain

regulatory actions by the OCC.

As explained further below, we conclude that the proposed automated generation of a SAR

narrative is consistent with 12 C.F.R. § 21.11(c). This conclusion is based on the

Bank’s representation that filed SARs will in fact contain all required elements outlined in the

SAR Form instructions and applicable FinCEN guidance. We further conclude that the OCC’s

SAR and BSA/AML Compliance Program regulations permit a bank to file a Structuring SAR

based solely on an alert under the conditions and limitations described in your request letter, and

1 12 C.F.R. § 21.11(c).

2 31 U.S.C. § 5318(g) and 31 C.F.R. § 1020.320.

3 12 C.F.R. § 21.21.

2

subject to certain limitations described below. Finally, the OCC is open to engaging in regular

discussions between the Bank and appropriate OCC personnel, including providing proactive and

timely feedback relating to this automation proposal, but declines to offer regulatory forbearance

as you have requested.

I.

Background

The Bank is proposing to streamline the filing of certain Structuring SARs by instituting an

automated process that (i) identifies potential structuring transactions involving the accounts and

transactions of U.S. consumer customers based upon alerts generated by a set of pre-determined

and limited structuring scenarios and (ii) populates SAR form and narrative fields using available

customer and transaction information. The SAR narrative fields will be automatically generated

using computer software and will contain all relevant information and data points currently

included in the Bank’s Structuring SARs.4 SARs filed pursuant to this process will generally be

filed within 30 days of the date of the alert

and (ii) populates SAR form and narrative fields using available

customer and transaction information. The SAR narrative fields will be automatically generated

using computer software and will contain all relevant information and data points currently

included in the Bank’s Structuring SARs.4 SARs filed pursuant to this process will generally be

filed within 30 days of the date of the alert. The Bank proposes using this streamlined reporting

only when an alert relates solely to potential structuring activity, which is defined by reference to

FinCEN regulations and to the SAR form.5

As proposed, the Bank would no longer conduct manual investigations or reviews into the subset

of alerts associated with the automated process. To ensure that a manual review is performed in

appropriate cases, the Bank will remove certain alerts from the automated process and subject

them to a normal investigation, based on specified criteria. Specifically, prior to filing the

Structuring SAR, the Bank will remove alerts from the automatic reporting process and conduct

a manual investigation using risk-based guardrails. These guardrails address, among other

things: (1) any non-structuring alerts, (2) prior customer case and SAR history,6 and (3) other

high risk activities in close proximity to the potential structuring.7 These criteria are intended to

ensure that the only alerts subject to this automated process are those solely related to potential

structuring activity and that a manual investigation is undertaken when there are indicia of other

suspicious activity or the alerts involve customers with repeat SAR filings. Moreover, after a

SAR related to a structuring alert has been filed, the Bank will monitor the relevant customer

account for potential continuing suspicious activity and perform a manual review of the both the

original and subsequent transactions if any type of alert occurs within 90 days

n there are indicia of other

suspicious activity or the alerts involve customers with repeat SAR filings. Moreover, after a

SAR related to a structuring alert has been filed, the Bank will monitor the relevant customer

account for potential continuing suspicious activity and perform a manual review of the both the

original and subsequent transactions if any type of alert occurs within 90 days. Furthermore, a

request received from a law enforcement agency post-filing for underlying Structuring SAR data

4 These data points will include: (1) customer name, account type(s), and account number(s) involved, (2) basic

customer information, including account types they have, duration of customer relationship, and employment

information, where available, (3) listing or summary of reportable cash transaction activity, (4) date(s) and location

of branch(es) where the activity took place, (5) in the case of an alert generated by a branch employee, the text

written by the branch employee, and (6) a standardized comma separated values (CSV) file containing all reportable

transactions.

5 FinCEN regulations define structuring as follows: “[a] person structures a transaction if that person … conducts or

attempts to conduct one or more transactions in currency, in any amount, at one or more financial institutions, on

one or more days, in any manner, for the purpose of evading the [Bank Secrecy Act] reporting requirements.” 31

C.F.R. § 1010.100(xx).

6 For example, a prior SAR filing will automatically preclude a customer account from inclusion in the automated

process; however, a prior closed alert that does not ultimately result in a SAR filing would not result in an exclusion

from the automated process.

7 For example, if a customer has wires to or from certain high risk jurisdictions in close proximity to the relevant

cash activity, then the structuring alert will not be subject to the automated process.

er account from inclusion in the automated

process; however, a prior closed alert that does not ultimately result in a SAR filing would not result in an exclusion

from the automated process.

7 For example, if a customer has wires to or from certain high risk jurisdictions in close proximity to the relevant

cash activity, then the structuring alert will not be subject to the automated process.

3

will trigger a manual investigation and an additional or amended SAR filing, if necessary.

Finally, the Bank will perform parallel sample testing post-filing by manually reviewing the

quality of a subset of the SARs filed, to determine whether additional information should have

been included in the original automated Structuring SARs.8 Any identified deficiencies will be

remedied with an amended SAR filing and these testing results will be used to enhance the

streamlined reporting processes on a prospective basis.

II.

Legal Analysis

Under the OCC’s SAR Regulation, national banks generally must “file a SAR with the

appropriate Federal law enforcement agencies and the Department of the Treasury on the form

prescribed by the OCC and in accordance with the form’s instructions” no later than 30 days

after the date of detection of facts that may constitute a required basis for filing a SAR.9 One

such required basis for filing a report is where the bank “knows, suspects, or has reason to

suspect” a transaction, or series of transactions, aggregating $5,000 or more “is designed to

evade any regulations promulgated under the Bank Secrecy Act.”10 This provision requires

filing SARs when, among other things, a Bank identifies potential structuring activity.11 Under

the OCC’s Compliance Program Regulations, national banks are required to “establish and

maintain procedures reasonably designed to assure and monitor their compliance with the

requirements of [the Bank Secrecy Act], and the implementing regulations promulgated

thereunder by the Department of the Treasury.”12 Under this regulation, na

a Bank identifies potential structuring activity.11 Under

the OCC’s Compliance Program Regulations, national banks are required to “establish and

maintain procedures reasonably designed to assure and monitor their compliance with the

requirements of [the Bank Secrecy Act], and the implementing regulations promulgated

thereunder by the Department of the Treasury.”12 Under this regulation, national banks must

“develop and provide for the continued administration of a program reasonably designed to

assure and monitor compliance with the recordkeeping and reporting requirements” of the Bank

Secrecy Act, which includes the filing of SARs.13

As noted previously, the proposed automated Structuring SAR proposal raises questions under

both the OCC’s SAR regulation and the OCC’s BSA/AML Compliance Program regulation. We

address each of these below.

a. Automated SAR Narrative

You have asked whether the automated generation of SAR narratives is consistent with the

OCC’s SAR regulation. The OCC’s SAR regulation provides that if a bank is required to file a

SAR, the bank must submit a “completed SAR” to FinCEN that is “on the form prescribed by the

OCC and in accordance with the form’s instructions.”14 The OCC’s regulation does not specify

8 The request letter states that the Bank will conduct this post-filing sample testing during a trial period. The bank’s

risk governance development for this new process should include post-filing quality assurance testing.

9 12 C.F.R. § 21.11(c), (d).

10 12 C.F.R. § 21.11(c)(4)(ii).

11 See FEDERAL FINANCIAL INSTITUTIONS EXAMINATION COUNCIL (FFIEC), BANK SECRECY ACT ANTI-MONEY

LAUNDERING EXAMINATION MANUAL, SUSPICIOUS ACTIVITY REPORTING—OVERVIEW, 60 (2014).

12 12 C.F.R. § 21.21(a).

13 12 C.F.R. § 21.21(c). See 31 U.S.C. § 5318(g) (authorizing regulations to require reports on “any suspicious

transaction relevant to a possible violation of law or regulation”), 31 C.F.R

).

11 See FEDERAL FINANCIAL INSTITUTIONS EXAMINATION COUNCIL (FFIEC), BANK SECRECY ACT ANTI-MONEY

LAUNDERING EXAMINATION MANUAL, SUSPICIOUS ACTIVITY REPORTING—OVERVIEW, 60 (2014).

12 12 C.F.R. § 21.21(a).

13 12 C.F.R. § 21.21(c). See 31 U.S.C. § 5318(g) (authorizing regulations to require reports on “any suspicious

transaction relevant to a possible violation of law or regulation”), 31 C.F.R. § 1020.320 (FinCEN’s implementing

regulations applicable to national banks), 12 C.F.R. § 21.11 (OCC’s regulations).

14 12 C.F.R. § 21.11(c).

4

how the form should be completed or what it must contain apart from these references to

completing the SAR Form in accordance with the instructions, which was purposefully done to

ensure that all financial institutions had uniform guidance on the reporting requirements.15 The

SAR Form and accompanying instructions are published by FinCEN, which issues and regularly

updates the SAR Form after providing notice-and-comment in the Federal Register.16

Accordingly, whether a SAR narrative satisfies 12 C.F.R. § 21.11(c) is determined by reference

to FinCEN’s SAR Form, as well as available guidance from FinCEN on the necessary contents

of the SAR narrative.

Here, the Bank represents that the data and information provided under its automated process

will be the same type of data and information that the Bank currently includes in its Structuring

SARs. If the filed SARs in fact contain all required elements outlined in the SAR Form

instructions and applicable FinCEN guidance, then it would be permissible under the OCC’s

SAR regulation. FinCEN ultimately has interpretive authority with respect to the SAR form and

its instructions, and they may be able to provide a more definitive response on this question.

b

udes in its Structuring

SARs. If the filed SARs in fact contain all required elements outlined in the SAR Form

instructions and applicable FinCEN guidance, then it would be permissible under the OCC’s

SAR regulation. FinCEN ultimately has interpretive authority with respect to the SAR form and

its instructions, and they may be able to provide a more definitive response on this question.

b. Automated Filings

You have also asked whether the OCC’s SAR regulation permits a bank to file a Structuring

SAR based solely on an automated alert, that is, without performing a manual investigation,

under the circumstances described in your request letter. The OCC’s SAR regulation sets forth

several categories of circumstances where a SAR filing is required for transactions that

encompass potentially suspicious activity under the Bank Secrecy Act and other federal laws.

The regulatory language regarding the filing obligation and scope of investigation or review vary

depending on the nature of the suspicious activity in question.17 With respect to structuring

transactions, the regulation specifically requires the filing of a SAR if the bank “knows, suspects,

or has reason to suspect that . . . the transaction is designed to evade any regulation promulgated

under the Bank Secrecy Act.”18 This “knows, suspects, or has reason to suspect” language

incorporates a concept of due diligence into the reporting procedures—banks are generally

required to review transactions to determine whether they are, in fact, suspicious to ensure that

all necessary reports are completed and filed.19 However, the nature and extent of this review

need not be the same for all transaction types and potential money laundering typologies, and

different transaction fact patterns involve different risks and necessarily require different types of

judgment.

As a general matter, the due diligence standard requires greater scrutiny and more involved

judgments for higher risk and more complex transactions and accounts

d extent of this review

need not be the same for all transaction types and potential money laundering typologies, and

different transaction fact patterns involve different risks and necessarily require different types of

judgment.

As a general matter, the due diligence standard requires greater scrutiny and more involved

judgments for higher risk and more complex transactions and accounts. For example, while a

series of transactions all under the reporting thresholds and in close proximity may provide an

objective reason to suspect that structuring has occurred, a deviation from customary account

15 See 61 F.R. 4332, 4333 (Feb. 5, 1996) (proposing the original SAR form for notice-and-comment); 82 F.R. 9109,

9109 (Feb. 2, 2017) (requesting comments on revisions to the SAR form).

16 75 F.R. 63,545 (Oct. 15, 2010).

17 12 C.F.R. § 21.11(c).

18 12 C.F.R. § 21.11(c)(4)(ii).

19 See 61 F.R. 4326, 4328 (Feb. 5, 1996) (noting that the banking agencies incorporated FinCEN’s proposed “knows,

suspects, or has reason to suspect” language into the SAR regulations to incorporate a due diligence standard into

reporting).

5

activity might require a manual review to determine if there is a basis for suspicion prior to filing

a SAR.20 For this reason, the OCC’s SAR regulations include additional language that clearly

provides for additional investigation after an alert for other reporting categories or

circumstances, such as when the basis for reporting is that the transaction “has no business or

apparent lawful purpose or is not the sort in which the particular customer would normally be

expected to engage.”21 Such a SAR must be submitted when “the institution knows of no

reasonable explanation for the transaction after examining the available facts, including the

background and possible purposes of the transaction.”22

Here, the Bank has designed a process intended to ensure all mandatory Structuring SARs are

filed with all relevant informa

ular customer would normally be

expected to engage.”21 Such a SAR must be submitted when “the institution knows of no

reasonable explanation for the transaction after examining the available facts, including the

background and possible purposes of the transaction.”22

Here, the Bank has designed a process intended to ensure all mandatory Structuring SARs are

filed with all relevant information for potential structuring provided to law enforcement, and

includes risk-based criteria to identify cases warranting additional review and removing these

cases from the automated process. As indicated by the regulatory language, extensive

investigation is generally not required for the identification of potential structuring, and, relative

to other types of potential money laundering, it is less susceptible to errors in an automated

process given the lack of complexity in the underlying judgments. A bank is more easily able to

identify a basis to suspect that structuring has occurred based on an automated review of

transaction values and frequency and other considerations, while other types of suspicious

activities may require more involved judgments.

While potential structuring is lower risk and therefore more readily automated, automation of

any SAR filing process raises the possibility that suspicious activities will go unreported due to

the absence of a more involved review. Accordingly, automated filing of Structuring SARs is

only permissible to the extent that it is supported by strong risk governance that remove higher

risk transactions from the automated process. In this regard, the Bank’s proposal also outlines

several risk-based criteria that are intended to ensure that transactions requiring more involved

review will be subject to appropriate manual reviews, which are commensurate with the risks of

the U.S. consumer accounts subject to the automated process

d by strong risk governance that remove higher

risk transactions from the automated process. In this regard, the Bank’s proposal also outlines

several risk-based criteria that are intended to ensure that transactions requiring more involved

review will be subject to appropriate manual reviews, which are commensurate with the risks of

the U.S. consumer accounts subject to the automated process. Specifically, the Bank will,

among other things, perform a manual investigation if any non-structuring alert activity is

identified, if another alert is generated within 90 days, if there have been previous SAR filings

involving the customer, and if there is a follow up request from law enforcement. The Bank’s

proposed risk-based guardrails as set forth in your request letter appear reasonably designed to

ensure manual review is performed in appropriate circumstances based on the relevant accounts

and information presently available, and, as described below, the OCC will continue to review

the effectiveness of the Bank’s risk-based guardrails during the development and implementation

process. Based on these considerations, the Bank’s proposed automation of Structuring SARs is

legally consistent with the OCC’s SAR regulations.

20 Of course, a bank may rebut this suspicion of potential structuring through a manual investigation.

21 12 C.F.R. § 21.11(c)(4)(iii).

22 Id. (emphasis added).

t and implementation

process. Based on these considerations, the Bank’s proposed automation of Structuring SARs is

legally consistent with the OCC’s SAR regulations.

20 Of course, a bank may rebut this suspicion of potential structuring through a manual investigation.

21 12 C.F.R. § 21.11(c)(4)(iii).

22 Id. (emphasis added).

6

c. Compliance Program Regulations

While your request letter does not directly address the OCC’s BSA/AML Compliance Program

regulation, 12 C.F.R. § 21.21, this request also clearly implicates that regulation. The OCC’s

Compliance Program regulation requires that banks “develop and provide for the continued

administration of a program reasonably designed to assure and monitor compliance with the

recordkeeping and reporting requirements” of the Bank Secrecy Act.23 While both the OCC’s

SAR regulation and BSA/AML Compliance Program regulations impose requirements regarding

the filing of SARs, each regulation serves a different purpose and imposes distinct obligations.

As discussed above, the OCC’s SAR regulation is focused on ensuring that potentially suspicious

activities are reported to facilitate the identification of possible money laundering, terrorist

financing and other Federal criminal violations. The Bank’s proposed automation of these

Structuring SARs, based on the transactions and accounts covered and the nature of the

suspicious activity in question, should result in the Bank identifying and reporting on all

potential structuring SARs required to be filed under C.F.R. § 21.11. However, even if the Bank

files all minimally required Structuring SARs, it is possible that the automated process may not

be “reasonably designed” to achieve compliance with its reporting obligations as required by the

Compliance Program regulation

ity in question, should result in the Bank identifying and reporting on all

potential structuring SARs required to be filed under C.F.R. § 21.11. However, even if the Bank

files all minimally required Structuring SARs, it is possible that the automated process may not

be “reasonably designed” to achieve compliance with its reporting obligations as required by the

Compliance Program regulation. For example, if the automated process were not regularly

overseen, evaluated and updated to ensure that it is reasonably designed to produce useful

information to law enforcement, this could raise issues under the BSA/AML Compliance

Program regulation. Moreover, if the system materially fails to identify instances of structuring

or results in alert backlogs, then these could be issues under both the SAR and BSA/AML

Compliance Program regulations. Accordingly, the OCC expects that, after implementation, the

bank will regularly review and update these processes to ensure that the automated SAR filing

process remains reasonably designed to achieve compliance with the OCC’s BSA/AML

Compliance Program regulation.

d. Regulatory Relief Request

Your letter also requested regulatory relief to conduct this initiative within a “regulatory

sandbox.” Your regulatory sandbox request states “This relief would be in the form of an agile

approach to supervisory oversight, which would include the OCC’s full access, evaluation, and

participation in the initiative development, but would not include regulatory outcomes such as

matters requiring attention, violations of law or financial penalties

duct this initiative within a “regulatory

sandbox.” Your regulatory sandbox request states “This relief would be in the form of an agile

approach to supervisory oversight, which would include the OCC’s full access, evaluation, and

participation in the initiative development, but would not include regulatory outcomes such as

matters requiring attention, violations of law or financial penalties. [The Bank] welcomes the

OCC to consider ways to participate in reviewing the initiative outcomes outside of its standard

examination processes to ensure effectiveness and provide feedback about the initiative

development.”

The OCC supports responsible innovation in the national banking system that enhances the

safety and soundness of the federal banking system, including responsibly implemented

innovative approaches to meeting the compliance obligations under the Bank Secrecy Act.24

23 12 C.F.R. § 21.21(c).

24 For example, the OCC, along with the other Federal Banking Agencies and FinCEN, issued a joint statement

encouraging responsible innovative efforts to combat money laundering and terrorist financing. See OCC ET. AL,

JOINT STATEMENT ON INNOVATIVE EFFORTS TO COMBAT MONEY LAUNDERING AND TERRORIST FINANCING (Dec. 3,

7

While the OCC encourages responsible innovation within the federal banking system, a

prerequisite for such innovation has always been compliance with all applicable laws and

regulations at the time of implementation.25 The OCC therefore is receptive to the Bank’s efforts

to automate Structuring SAR filing processes, which would provide consistency in the reporting

of potential structuring events to FinCEN, possibly improve the utility and timing of data

available to law enforcement, and enable all stakeholders to focus resources on more complex

patterns of financial activity that require human review

ion.25 The OCC therefore is receptive to the Bank’s efforts

to automate Structuring SAR filing processes, which would provide consistency in the reporting

of potential structuring events to FinCEN, possibly improve the utility and timing of data

available to law enforcement, and enable all stakeholders to focus resources on more complex

patterns of financial activity that require human review. The OCC is also open to an agile and

transparent supervisory approach while the Bank is building this automated solution for filing

Structuring SARs and conducting user acceptance testing. The OCC, however, will not approve

a regulatory sandbox that includes forbearance on regulatory issues for the Bank’s initiative for

the automation of Structuring SAR filings.

III.

Conclusion

The OCC’s determination regarding the Bank’s proposed automated process for certain

Structuring SARs is based on the representations made by the Bank. The OCC is not opining on

whether SARs filed pursuant to this new process are eligible for the safe harbor contained in 12

C.F.R. § 21.11(l). This safe harbor provision incorporates the statutory safe harbor set forth in

31 U.S.C. 5318(g)(3), which is part of the Bank Secrecy Act. FinCEN has interpretive authority

with respect to the Bank Secrecy Act and, as a result, FinCEN’s conclusions on the scope of the

statutory safe harbor would be determinative for purposes of interpreting the OCC’s regulation.

The OCC is also not opining on the consistency of the proposed streamlined system with

FinCEN’s parallel regulations, which you have separately addressed to FinCEN. Furthermore,

this determination does not mean that the OCC has concluded that every Structuring SAR filed

under this automated process will be consistent with the regulatory requirements and applicable

FinCEN guidance. For example, it is possible that the Bank’s automated process may

inadvertently omit information or incompletely fill out the SAR form

you have separately addressed to FinCEN. Furthermore,

this determination does not mean that the OCC has concluded that every Structuring SAR filed

under this automated process will be consistent with the regulatory requirements and applicable

FinCEN guidance. For example, it is possible that the Bank’s automated process may

inadvertently omit information or incompletely fill out the SAR form.

Finally, I also reiterate that in implementing its automated process, the Bank must ensure that it

has developed and deployed appropriate risk governance to enable the bank to identify, measure,

monitor, and control for the risks associated with the automated process. The Bank also has a

continuing obligation to employ appropriate oversight of the automated process—including

periodic review of the quality of the automated Structuring SARs filed, the tailoring of the

Bank’s structuring alerts, and deploy appropriate risk governance procedures—to ensure that the

automated process is continually functioning in a safe and sound manner. Accordingly, once

2018) (hereinafter, “Interagency BSA Innovation Statement”), available at https://www.occ.gov/news-

issuances/news-releases/2018/nr-occ-2018-130a.pdf

25 The OCC has stated that compliance with applicable laws and regulations is a prerequisite for responsible

innovation on numerous occasions. For example, the OCC recently proposed an Innovation Pilot Program to

support responsible innovation in the U.S. federal banking system. See OCC INNOVATION PILOT PROGRAM (Apr.

2019), available at https://www.occ.treas.gov/topics/responsible-innovation/occ-innovation-pilot-program.pdf

iance with applicable laws and regulations is a prerequisite for responsible

innovation on numerous occasions. For example, the OCC recently proposed an Innovation Pilot Program to

support responsible innovation in the U.S. federal banking system. See OCC INNOVATION PILOT PROGRAM (Apr.

2019), available at https://www.occ.treas.gov/topics/responsible-innovation/occ-innovation-pilot-program.pdf. The

Innovation Pilot Program clearly notes that the agency would not provide “statutory or regulatory waivers and does

not absolve entities participating in the program from complying with applicable laws and regulations.” Similarly,

the recently issued interagency statement on innovative efforts in BSA/AML compliance programs noted that

“compliance with the BSA and its regulations is critically important in protecting the U.S. financial system” and,

therefore, that “banks must continue to meet their BSA/AML compliance obligations, as well as ensure the ongoing

safety and soundness of the bank, when developing pilot programs and other innovative approaches.” See

Interagency BSA Innovation Statement at 2.

8

implemented, the Bank should regularly review the automated processes and the associated risk

governance and make any necessary updates.

If the Bank plans to materially modify the automated process, such as by expansion of the

accounts covered, the automation of additional types of SARs or alerts, or the modification of the

risk-based guardrails, the Bank must continue to ensure that sound risk management and

commensurate controls are in place. The OCC will monitor any such changes through its

ordinary supervisory processes.

Please feel free to contact me if you have any questions.

Sincerely,

signed

Jonathan V. Gould

Senior Deputy Comptroller and Chief Counsel