APRIL 2007

1. APRIL 2007 Anti-Money Laundering – Global Best Practices William Langford Director of Global Anti-Money Laundering

2. Framework for Anti-Money Laundering Compliance Global AML Policy Corporate Minimum Standards— KYC – High Risk Customers— Correspondent Banking— Country Risk Ranking— Suspect Screening Anti-Money Laundering – Global Best Practices Line of Business AML Policies and Procedures

3. Framework (Cont’d) Anti-Money Laundering – Global Best Practices

4. Framework (Cont’d) Anti-Money Laundering – Global Best Practices

5. Money Laundering Risk Assessment and Mitigation • Benefits of an effective BSA/AML risk assessment process include: • Helps to identify the bank’s BSA/AML risk profile. • Enables the bank to apply the appropriate risk management processes to the BSA/AML Compliance program to mitigate risk. • Allows management to better identify and mitigate gaps in the bank’s controls. • Provides a comprehensive analysis of the BSA/AML risk in a concise and organized presentation. Step 1: Identify Specific Risk Categories Identify specific risk categories, (i.e., products, services, customers, entities, and geographic locations) unique to the bank. Step 2: Conduct Detailed Analysis Conduct a more detailed analysis of the data identified to better assess the risk within these categories. In reviewing the risk assessment, the examiner should determine whether management has considered all products, services, customers, and geographic locations, and whether management’s detailed analysis within these specific risk categories was adequate.

6. Regulators LOB Senior Management Senior Management Money Laundering Risk Assessment – Primary Audiences LOB Senior Management requires an accurate understanding of the nature of their AML exposure and a level of comfort with the measures and controls in place to mitigate this business risk Senior Management requires a strong level of confidence that our AML program currently maintains appropriate controls to mitigate the reputation and business risks of money laundering-related activity, and that our AML program is prepared to respond appropriately to future challenges Regulators expect that we understand our AML risks, have created appropriate controls to mitigate them, and can support both the understanding of risks and our associated controls with appropriate documentation (including an AML risk assessment)

7. BSA Officer - Compliance Officer Internal Audit Testing Units Money Laundering Risk Assessment – Primary Audiences Internal Audit has a mandate to ensure that LOBs possess a sufficient understanding of their business risks, a system of internal controls adequate to mitigate these risks effectively, and LOB senior management oversight of the AML risk management process The BSA Officer or Compliance Officer is responsible for the development, implementation and oversight of the AML program, and requires an accurate assessment regarding LOB AML risks and controls in order to make decisions regarding the shape and direction of the program Similar to Internal Audit, Compliance Testing Units utilize risk assessments to ensure that risks are identified, measured, monitored, and controlled. Risk assessments are key part of the scoping process.

8. Money Laundering Risk Assessment and Mitigation • Measuring Susceptibility to Money Laundering • Stratify Risk Assessment by Business Units • Quantify Risk Levels and Control Adequacy • Roll Up Results • Communicate Risk Levels and Trends • Macro-Level Measurement Possibilities • Capital • Total Assets or Assets Under Management • Revenue

9. Key Enterprise Risks Reputation Risk Compliance Risk Legal Risk

10. Risk Assessment Internal Controls • Identify & Measure Risk: • Products • Services • Customers • Geographic locations • Develop Applicable: • Policies • Procedures • Systems • Controls Results Money Laundering Risk Assessment and Mitigation • Risk Assessment Link to the BSA/AML Compliance Program – FFIEC Manual • Risk-Based BSA Compliance Program • Internal controls • Audit • BSA Compliance Officer • Training

11. Money Laundering Risk Assessment and Mitigation • Inherent Risks • Products • Clients • Geography (Domestic or International Exposure) • Forward Looking – changes in business strategy; new products, expanding to new markets, or exiting products/markets • Risk Mitigation • Governance • Management Oversight/Resources • Customer/Client Identification and Due Diligence • Management Information Systems • BSA Reporting (CTRs, SARs) • Training • Testing/Audit Coverage/Examination Findings

12. Money Laundering Risk Assessment and Mitigation Product Risk – FFIEC Manual Certain products and services offered by banks may pose a higher risk of money laundering or terrorist financing depending on the nature of the specific product or service offered. Such products and services may facilitate a higher degree of anonymity, or involve the handling of high volumes of currency or currency equivalents. Some of these products and services are listed below, but the list is not all inclusive: Electronic funds payment services. Electronic Banking. Private banking (domestic and international. Trust and asset management services. Monetary instruments. Foreign correspondent accounts. Trade finance (letters of credit). Special use or concentration accounts. Lending activities (e.g., loans secured by cash collateral and marketable securities). Non-deposit account services (e.g., non deposit investment products and insurance).

13. Money Laundering Risk Assessment and Mitigation Client Risk – FFIEC Manual Although any type of account is potentially vulnerable to money laundering or terrorist financing, by the nature of their business, occupation, or anticipated transaction activity, certain customers and entities may pose specific risks. At this stage of the risk assessment process, it is essential that banks exercise judgment and neither define nor treat all members of a specific category of customer as posing the same level of risk. In assessing customer risk, banks should consider other variables, such as services sought and geographic locations. See the next page for a list of Customers and Entities that may pose specific risks to money laundering or terrorist financing.

14. Money Laundering Risk Assessment and Mitigation Client Risk – FFIEC Manual Foreign financial institutions, including banks and foreign money services providers (e.g., casas de cambio, currency exchanges, and money transmitters). Non-bank financial institutions (e.g., money services businesses; casinos and card clubs; brokers/dealers in securities; and dealers in precious metals, stones, or jewels). Senior foreign political figures and their immediate family members and close associates (politically exposed persons (PEPs)). Nonresident alien (NRA) and accounts of foreign individuals. Foreign corporations and domestic business entities, particularly offshore corporations (such as domestic shell companies and Private Investment Companies (PICs) and international business corporations (IBCs)) located in high-risk geographic locations. Deposit brokers, particularly foreign deposit brokers. Cash-intensive businesses (e.g., convenience stores, restaurants, retail stores, liquor stores, cigarette distributors, privately owned ATMs, vending machine operators, and parking garages). Non-governmental organizations and charities (foreign and domestic). Professional service providers (e.g., attorneys, accountants, doctors, real estate brokers).

15. Money Laundering Risk Assessment and Mitigation Geographic Risk – FFIEC Manual Domestic: HIDTAs and HIFCAs International: Countries subject to OFAC sanctions, including state sponsors of terrorism. Countries identified as supporting international terrorism under section 6(j) of the Export Administration Act of 1979, as determined by the Secretary of State. Jurisdictions determined to be “of primary money laundering concern” by the Secretary of the Treasury, and jurisdictions subject to special measures imposed by the Secretary of the Treasury, through FinCEN, pursuant to section 311 of the Patriot Act. Jurisdictions or countries identified as non-cooperative by the Financial Action Task Force on Money Laundering (FATF). Major money laundering countries and jurisdictions identified in the U.S. Department of State’s annual International Narcotics Control Strategy Report (INCSR), in particular, countries which are identified as jurisdictions of primary concern. Offshore financial centers (OFCs) as identified by the U.S. Department of State. Other countries identified by the bank as high-risk because of its prior experiences or other factors (e.g., legal considerations, or allegations of official corruption).

16. Money Laundering Risk Assessment and Mitigation Roll Up the Results • Risk Weighting – FFIEC Manual Appendix J • Document Your Results • Possible Proxies • Total Assets or Assets Under Management • Capital • Net Revenue • Interest Income/Noninterest Income • Market Exposure • Place the AML Exposure in the Context of the Enterprise

17. Money Laundering Risk Assessment and Mitigation Summarize the Results • Profile of the business • Key Inherent Risk Factors • Primary factors that contributed to the risk levels assigned • Key Mitigation Factors/Controls • Primary factors that contributed to the strength or weakness of controls • Residual Risk • Direction of Risk Trend • Where is your risk headed in the next 12-18 months? • Increasing? Decreasing? Stable?

18. Money Laundering Risk Assessment and Mitigation Now what? Keep your risk assessment up to date Per the FFIEC Manual, reassess BSA/AML risks at least every 12 to 18 months Dynamic if possible

19. Money Laundering Risk Assessment and Mitigation Now what? • Drive/Focus Resources • Training • Monitoring • Independent testing or Audit • Scoping • Validating the Assessment and Controls

20. Money Laundering Risk Assessment and Mitigation What about OFAC? Do you assess OFAC as part of your AML risk assessment? Resources: FFIEC Manual – Appendix M OFAC Website