FinCEN’s penalty assessment against Gibraltar Private Bank reads like a Stephen King novel for BSA compliance officers. The ongoing deficiencies and either the willful blindness or ignorance by Gibraltar caused me heartburn just reading the assessment report.

Gilbraltar’s issues have been ongoing since at least 2010, when the OCC first warned Gibraltar of its BSA deficiencies. A Consent order was placed in 2014, and finally, both the OCC and FinCEN assessed a combined total of $4 million in penalties in February.

Gibraltar failed to implement and maintain an adequate AML program, develop and implement an adequate customer identification program, and detect and adequately report suspicious transactions. Among the issues identified in the report:

• Internal controls did not adequately monitor, detect, or report suspicious activity
• Procedures for monitoring, detecting, and reporting suspicious activity were ineffective
  • “Although Gibraltar used a software system to monitor its accounts for unusual activity going through the Bank, the system and procedures were so flawed, that Gibraltar systematically failed to identify and timely report transactions through numerous accounts that exhibited indicia of money laundering or other suspicious activity.”
  • “Gibraltar’s transaction monitoring system contained account opening information and customer risk profiles that were frequently incomplete, inaccurate, and lacked sufficient analysis and validation. In addition, the anticipated account activity for some customers often did not match the actual transaction activity. Because of the incomplete and inaccurate information, when the Bank’s automated transaction monitoring system generated alerts on certain customers, analysts in the BSA department could not determine effectively when a change in those customers’ activities should have resulted in a change to those customers’ risk ratings.”
  • “Gibraltar’s automated monitoring system deficiencies resulted in its generation of an unmanageable number of alerts that included large numbers of false positives.” “The problems associated with the system were due to Gibraltar’s failure to adequately tailor the parameters and thresholds of the alerts generated by the system to match the high-risk activities it sought to identify and control.” “Gibraltar did not validate or independently test the system’s parameters and thresholds to reduce the number of false positive alerts the system generated. Consequently, Gibraltar’s failure to accurately set, validate, and test the automated monitoring system left Gibraltar overwhelmed by the large volume of alerts, many of which yielded false positive results. Hampered by a large volume, Gibraltar’s BSA analysts were also unable to timely or adequately review or investigate all of the alerts.”
• Gibraltar failed to adequately assess the money laundering risks associated with its customers
  • “Gibraltar failed to adequately risk rate its high-risk customers and their respective accounts, leaving the Bank ill-equipped to adequately monitor transactions based on a customer’s particular level of risk or the account’s purpose and expected activity. Moreover, on some occasions, when Gibraltar detected a deviation in a customer’s activity from anticipated activity identified at account opening, it would change the anticipated activity in the account rather than changing customer’s risk rating, even when the customer should have been identified as high risk.”
• Implementation of BSA training was continually inadequate
  • “It failed to provide appropriate training tailored to the needs of specific positions, departments, board members, and other personnel.”
• Failed to maintain a sufficient customer identification program
  • “Gibraltar’s customer due diligence was insufficient to develop accurate risk profiles and to effectively understand its customers’ business and predicted activity.”
  • “Gibraltar also failed to incorporate its customer identification program into its internal controls, including transaction monitoring.”
• Failed to adequately report suspicious activity
  • Filed SARs well over 60 days from the time that it knew, or had reason to know, transactions were suspicious.

While Gibraltar’s example is extreme, it should remind credit unions of the need to have a fully functional BSA compliance program, and that all levels of the credit union are involved with compliance – from new account staff capturing member information, to the Board ensuring that the program is functioning as it should.

https://www.fincen.gov/news_room/nr/pdf/Gibraltar_%20Assessment.pdf