Automation plays a key role in the action plan by the Office of the Comptroller of the Currency (OCC) for USAA Federal Savings Bank, which it fined $60 million in a March 17 cease-and-desist order.

The $200.3 billion bank will be required “to take broad and comprehensive actions to improve internal controls, training, staffing and third-party risk management of its BSA [Bank Secrecy Act]/AML program,” according to the OCC. The bank was fined for deficiencies in its BSA/AML compliance program.

The OCC ordered the San Antonio-based bank to undertake specific automation-focused steps, including:

• Validating the data inputs for its automated systems, including inputs from all products, services and transactions. The order specifically mentions that this includes “peer-to-peer transactions” and “having sufficient management information systems and metrics to validate automated system settings and thresholds and to measure the effectiveness of the automated system and individual scenarios and adjust the system, consistent with the Bank’s money laundering, terrorist financing and other illicit financial activity risk profile and operations, as necessary”;
• Identifying areas outside of the monitoring system’s analysis and implementing manual processes to ensure the bank identifies any suspicious activity not reviewed by an automated system; and
• Completing an independent validation of the bank’s automated monitoring system, after which the USAA must report the validation findings in writing to its mandated compliance committee and to the assistant deputy comptroller within 30 days of completion.

The bank has 30 days to submit an action to the OCC, but Christian Bove, lead director at USAA, told Bank Automation News that the bank already has begun to address the identified issues.

“This occurred because we did not sufficiently strengthen the capabilities and expertise necessary to meet BSA/AML requirements,” Bove said. “USAA has already made progress in many critical areas by investing in new systems and training, enhancing staffing and expertise, and improving our processes.”

Other technology-related pain points identified by the OCC include:

• Providing evidence of transactional analysis, including trend analysis and analysis of significant and unexplained variance in account activity;
• Creating effective management information systems, “commensurate with the bank’s size and risk profile, that provide timely and accurate periodic reporting to senior management and the Board of the status of the Bank’ BSA/AML Program,” the OCC cease and disorder noted;
• Identifying, evaluating and reporting potential suspicious activities in account opening or transactions; and
• Providing for “monitoring systems that apply appropriate rules, thresholds and filters for monitoring transactions, accounts, customers, products, services, and geographic areas commensurate with the Bank’s BSA/AML risk profile,” the order stated.