Your AML Program Is Not a Bank's

Many dealer AML programs began as a bank or broker-dealer template. The result is a program that promises procedures the law does not require and the staff does not perform. That gap is a finding waiting to happen.

Why over-promising is a problem

An independent tester, a bank's due diligence team, or an examiner will compare your written program against what your people actually do. If the program says you verify every customer's identity against documentary evidence before opening an account, and you do not, the finding is that you failed to follow your own program. It does not help that the rule you failed to follow never applied to you.

The fix is not to label inapplicable provisions "voluntary." A voluntary procedure in a written program is still a procedure you said you would follow. The fix is to remove them and document why.

Four rules that do not apply to dealers

Customer Identification Program

The CIP rules apply to banks, broker-dealers, mutual funds, and futures commission merchants and introducing brokers. Dealers in precious metals, precious stones, or jewels are not on that list. A dealer still needs to know who its customers are, at a level that fits its risk, which is why we rename this section of a dealer program "Know Your Customer Procedures" and write it to the dealer's actual practice.

The CDD rule and beneficial ownership certifications

FinCEN's customer due diligence rule, including the requirement to identify and verify the beneficial owners of legal entity customers, applies to covered financial institutions. Dealers are not covered financial institutions under that rule. A risk-based program should still look behind higher-risk entity customers, and sanctions screening requires checking ownership under OFAC's 50 percent rule. But the bank-style certification form is not required.

Mandatory suspicious activity reporting

Part 1027 contains no mandatory SAR rule for dealers. Dealers may file SARs voluntarily, and the statutory safe harbor protects good-faith voluntary filings. Your program should say how you decide whether to file. It should not say you must file within 30 days of detecting facts that may constitute a basis for filing, because that is the bank rule.

Private banking and PEP due diligence

The enhanced due diligence rules for private banking accounts and senior foreign political figures under Section 312 apply to covered financial institutions. They do not apply to dealers. A dealer may treat a foreign official as a higher-risk customer as a matter of judgment, but a mandatory PEP screening program is not part of the dealer rule.

What does apply

A dealer program has four required parts under 31 CFR 1027.210: policies, procedures, and internal controls based on a risk assessment; a designated compliance officer; ongoing training for appropriate personnel; and independent testing. Add Form 8300 cash reporting and OFAC compliance, and you have the full set of federal obligations for most dealers.

The risk assessment is where a dealer program earns its keep. FinCEN directs dealers to consider the products they sell, their customers, suppliers, and distribution channels, and the geographic locations involved, including on the purchase side. Supplier risk is where some of the largest dealer prosecutions began.

Write down why

When we remove a provision, we record the reason in a Regulatory Basis Addendum: the rule, the institutions it covers, and the citation showing dealers are not among them. The addendum turns a question from an auditor ("why don't you have a CIP?") into a one-page answer.

A smaller program that your staff follows every day is stronger than a larger one they do not.