How are those ‘other’ high-risk customers doing?

As time goes on, I always find it harder and harder to keep up with old friends or classmates as frequently as I’d like. 

Weekly get-togethers turn into every other month, then years, and then stop happening altogether. 

The next time we do touch base, it never fails that a lot has happened since we last talked. 

Whether you refer to keeping tabs on your longtime high-risk customers as “keeping up with old friends” or not, a lot can be missed while your attention has been focused elsewhere.

With all the changes in the industry that have required your attention over the past several years, particularly in the area of BSA, it can be easy to lose touch with some customers. 

First there was the lead up to and implementation of the Beneficial Ownership Rule in 2018, which led to a lot of questions and time spent ensuring everyone was interpreting the rule correctly and complying accordingly. 

Now, everyone has had questions or spent a great deal of time and resources on hemp, CBD  and, for some states, medical and/or recreational marijuana. 

While each of those regulations, products and services certainly deserve the due diligence they are receiving, it is important to remember those “other” high-risk customers. 

Yeah, those.

They could be customers who have been on your high-risk list for years due to a SAR filing, structuring history or your cash-intensive businesses, privately held ATM owners, money service businesses, etc.  

Either way, if they are on your high-risk list, they deserve the same focus each review period as your newer high-risk customers. 

Let’s review how to keep up on this due diligence so your regulator doesn’t think you’ve slipped on reviewing your older high-risk customers.

Getting a baseline

What you already know about the customer is your baseline for the review. 

What information do you have on file to help you assess their recent activity? For customers that are identified during the account opening process as high risk, what types of enhanced due diligence (EDD) is done for them? 

The information obtained as part of the EDD process is critical for the review process to adequately assess any changes in expected behavior or identify any unusual patterns or activity based on the customer’s initial disclosures regarding the account.  

For customers who are elevated to high risk after the account has been established, consider some other types of EDD, such as internet searches, transaction records, internal loan records, internal staff information, or other information that can help you build a profile of activity. 

When was the last time you reviewed any financial statements on file as part of your review or did a social media search to get a better handle on what their activity might be related to?

Documentation

A lot of times high-risk customer monitoring starts out as a comprehensive review of the customer’s activity that is compared against the due diligence information obtained at account opening. Eventually though, documented notes might say something like “viewed three months of account statements with nothing unusual noted,” or my favorite, “no changes noted.” 

While those statements may be accurate, they probably won’t leave the examiners feeling confident that you have a true picture of the customer’s past three months.  

And remember, your review should include the entire customer relationship, not just one account that may have been flagged. 

This is especially important for customers with both individual and business accounts with your institution. 

Look at any transfers between entities or the owner and their entity to ensure the transfers have a legitimate business purpose. 

Be sure to leave detailed notes on what was reviewed and any findings. These notes will support any future actions on the customer, including removal from the high-risk list, potential regulatory filings, or even eventual account closure. 

Remember that an examiner will probably try and recreate your review, so make it easy to follow to ensure the examiner reaches the same conclusions as you.  

Managing the workload

You may be thinking you have no time to document so much information for so many high-risk customers. 

As important as it is to continually monitor your high-risk customers, it is equally important that the customers listed are truly high risk. 

There is nothing wrong with lowering a risk rating if your past few reviews clearly indicate the behavior has ceased or has been consistent and you are comfortable with it. Just remember to have clear documentation to explain why the rating was lowered and leave them on the list for reference.  

The benefit 

Keeping up with due diligence on your other high-risk customers will allow you to reduce the size of your high-risk list and hopefully save you some time down the road. 

It will allow you to supply your examiners with clear documentation of what is happening with these customers and will prevent you from being criticized for missing something on these other high-risk customers while you were busy keeping up with the newest high-risk concerns.