Question 1

What is third-party risk management (TPRM) under US banking regulations?

Accepted Answer

TPRM under US banking regulations is the structured process of managing risks from vendors, service providers, and partners as defined by the OCC/FDIC/Federal Reserve Interagency Guidance on Third-Party Relationships (June 2023). It covers the full vendor lifecycle from planning and due diligence through ongoing monitoring and termination. Banks retain full regulatory responsibility for all activities performed by third parties on their behalf.

Question 2

Does BSA/AML responsibility transfer to a vendor under US law?

Accepted Answer

No. Under FinCEN's BSA framework, a bank that engages a vendor to perform BSA/AML functions — such as transaction monitoring, SAR filing support, or CIP processing — remains fully responsible for BSA/AML compliance. Any violation by the vendor is treated as a violation by the bank. Banks must assess vendor BSA/AML controls during due diligence and conduct periodic testing.

Question 3

What does the OCC interagency guidance require for high-risk vendor contracts?

Accepted Answer

For high-risk vendors, contracts must include: SLAs with measurable performance standards, regulatory examination access rights, bank audit rights, data security and confidentiality obligations, GLBA-compliant incident notification timelines (30 days to primary regulator), termination provisions allowing exit for regulatory non-compliance, and sub-outsourcing controls.

Question 4

How does NY DFS Part 500 affect vendor risk management?

Accepted Answer

NY DFS Part 500 (Cybersecurity Requirements for Financial Services Companies) requires covered entities to ensure third-party service providers that access their systems or non-public information maintain minimum cybersecurity standards. This includes annual due diligence, contractual protections, and third-party policy monitoring. Violations can result in NY DFS enforcement actions and civil money penalties.

Question 5

What are the consequences of TPRM programme failures for US banks?

Accepted Answer

Consequences include OCC Matters Requiring Attention (MRAs) and Matters Requiring Immediate Attention (MRIAs), formal agreements or consent orders, civil money penalties (which can reach millions of dollars), FinCEN enforcement actions for BSA-related TPRM failures, reputational damage, and in serious cases, restrictions on new business activities until remediation is complete.

Question 6

How does FinCEN's April 2026 proposed AML overhaul affect TPRM?

Accepted Answer

FinCEN's April 7, 2026 proposed rule shifts the AML compliance standard from mere programme existence to demonstrated programme effectiveness. For TPRM, this means that vendor-managed BSA/AML functions — transaction monitoring, SAR filing support, CIP processing — will be evaluated on whether they produce accurate, timely results, not just whether a vendor contract and questionnaire exist. Banks should expect examiners to request evidence of actual monitoring outcomes (e.g., SAR filing rates, alert disposition accuracy) from vendor-operated systems. The proposed rule also significantly tightens the whistleblower framework, with awards of 10–30% of monetary penalties exceeding $1 million — increasing the risk that internal TPRM deficiencies surface through regulatory channels rather than self-reporting.

Question 7

What is a money laundering typology according to FATF?

Accepted Answer

A money laundering typology is a recurring operational pattern used to conceal the illicit origin of funds. FATF identifies and documents typologies through regular sector-specific reports to help obliged entities calibrate their monitoring systems. Each typology is associated with specific behavioural and documentary indicators that enable its detection. FinCEN supplements FATF typologies with its own Financial Trend Analyses targeted at US-specific patterns and vulnerabilities.

Question 8

Which documents are most commonly falsified in US money laundering schemes?

Accepted Answer

The most frequently falsified documents are source-of-funds evidence (pay stubs, sale agreements, loan contracts), financial statements (management accounts, tax returns), and beneficial ownership declarations including FinCEN BOI filings. In TBML operations, commercial invoices, certificates of origin, bills of lading, and AES export filings are systematically targeted for manipulation. Falsified FBAR filings to conceal foreign account holdings are also a documented pattern in complex schemes.

Question 9

When must a US financial institution file a Suspicious Activity Report (SAR)?

Accepted Answer

A SAR must be filed with FinCEN when a financial institution knows, suspects, or has reason to suspect that a transaction involves funds from illegal activity and the transaction involves $5,000 or more. The filing deadline is 30 calendar days from the date the suspicious activity was initially detected, extendable to 60 days if no suspect can be identified. Tipping off a subject about a SAR filing is prohibited and constitutes a federal offense under 31 USC §5318.

Question 10

What is the Corporate Transparency Act and how does it affect AML compliance?

Accepted Answer

The Corporate Transparency Act (CTA) 2021, effective January 1, 2024, requires most domestic and foreign companies operating in the United States to report beneficial ownership information (BOI) to FinCEN. Reporting companies must identify each beneficial owner — any individual owning 25% or more of the company, or exercising substantial control — by name, date of birth, address, and government-issued ID number. This information is stored in a non-public FinCEN database accessible to law enforcement and authorized financial institutions conducting customer due diligence.

Compliance

Third-Party Risk Management (TPRM): Complete US Guide

Money Laundering Typologies: Schemes and Document Red Flags

AML Red Flags: Suspicious Activity Indicators for US Compliance Teams

SOC 2 Compliance for SaaS in the US: Document Security, Controls and Audit Readiness

How to Choose an AML Solution: Evaluation Criteria and Checklist

US Financial Sector Cybersecurity: Doc Verification

E-Invoicing & Doc Validation: US Compliance in 2026

US AML Compliance Guide: What BSA and AMLA 2020 Mean

KYB: Business Document Verification for US Onboarding

Enterprise KYC Solutions Comparison: Features, Pricing and Compliance

AML Transaction Monitoring: Rules & Alerts

PEP Screening: Identifying Politically Exposed Persons

Sanctions Screening: OFAC, BSA/AML Compliance Best

Compliance Risk Assessment: A Practical Guide for US

GRC Guide: US Guide 2026

How to Build a Document Compliance Program from Scratch

US Privacy Law and Document Management: Practical

Vendor Compliance Certificate Verification: US Guide

KYC: The Complete Guide for US Businesses in 2026

Right to Work Check: US Employer Compliance Guide (I-9

Document Compliance Guide for US Businesses in 2026

Digital Identity in the US: REAL ID, NIST 800-63

Due diligence explained: complete checklist for US

Anti-Money Laundering: Complete US AML Compliance Guide

Equipment Leasing: Document Compliance in 2026

US Crypto KYC and Identity Verification Rules in 2026

US Privacy Law and Identity Documents: Compliance Guide

Beneficial Ownership Verification Requirements Under

KYC 2026: New Document Verification Requirements