Common use of Detecting and Reporting Suspicious Activity Clause in Contracts

Detecting and Reporting Suspicious Activity. Associates have a duty to understand their responsibilities for detecting and reporting suspicious activity. It is the requirement of RCS Third Party that Associates follow established “Know Your Customer” (or KYC) procedures; that any customer, Associate, or other suspicious activity (or possible suspicious activity) be promptly reported to designated persons as set forth in the Requirements; that all such reports be timely and diligently investigated by such designated persons; and to timely and comprehensively fulfill all suspicious activity report filing requirements by providing proper notice to RCS Third Party BSA/AML Compliance Officer. Any suspicious activity identified by RCS Third Party should be reported to the Bank’s Non-Traditional BSA Manager or designated BSA Staff in a timely manner upon identification via the established agreed upon reporting mechanism. RCS Third Party shall require that all Associates should maintain the strict confidentiality of all such suspicious activity investigations and reports. In pursuit of its obligations to diligence and oversight, RCS Third Party should develop or acquire tools for use in reviewing account activity. These tools, when deployed in conjunction with a formal risk management training program should represent a broad spectrum approach to detecting and reporting suspicious activity. Per the Requirements, tools and resources should include the following: a. Daily application reviews of: i. Account applications at addresses with prior known fraud history [****] = CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENT, MARKED BY BRACKETS, HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION PURSUANT TO RULE 406 OF THE SECURITIES ACT OF 1933, AS AMENDED. ii. Account application details, to include social security numbers, dates of birth and phone numbers, that may match prior established account with a history of suspect behavior iii. Account applications that appear to be associated with identified fraud rings iv. Unusual or suspicious transactional loan activity v. Any other alerts related to fraud or suspicious activity, as applicable Training for use and implementation of these resources is an ongoing process with emphasis on associative analysis and metrics base analytics is recommended. Training courses should include overview of AML requirements, OFAC program measures, and detailed review of Customer activity and behavior. Records of activity reviews, including copies of any correspondence and SAR’s should be retained in a central repository (such as a Client Relationship Manager), which provides record keeping at the account level. Any activity which is reviewed or investigated must be logged in the respective account record on the repository. Records of activity reviews should be held on file for no less than 5 years within the repository.

Detecting and Reporting Suspicious Activity. Associates have a duty to understand their responsibilities for detecting and reporting suspicious activity. It is the requirement of RCS Third Party that Associates follow established “Know Your Customer” (or KYC) procedures; that any customer, Associate, or other suspicious activity (or possible suspicious activity) be promptly reported to designated persons as set forth in the Requirements; that all such reports be timely and diligently investigated by such designated persons; and to timely and comprehensively fulfill all suspicious activity report filing requirements by providing proper notice to RCS Third Party BSA/AML Compliance Officer. Any suspicious activity identified by RCS Third Party should be reported to the BankFB’s Non-Traditional BSA Manager or designated BSA Staff in a timely manner upon identification via the established agreed upon reporting mechanism. RCS Third Party shall require that all Associates should maintain the strict confidentiality of all such suspicious activity investigations and reports. In pursuit of its obligations to diligence and oversight, RCS Third Party should develop or acquire tools for use in reviewing account activity. These tools, when deployed in conjunction with a formal risk management training program should represent a broad spectrum approach to detecting and reporting suspicious activity. Per the Requirements, tools and resources should include the following: a. Daily daily application reviews of: i. Account Loan applications at addresses with prior known fraud history [****] = CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENT, MARKED BY BRACKETS, HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION PURSUANT TO RULE 406 OF THE SECURITIES ACT OF 1933, AS AMENDED.history ii. Account Loan application details, to include social security numbers, dates of birth and phone numbers, that may match prior established account with a history of suspect behavior iii. Account Loan applications that appear to be associated with identified fraud rings iv. Unusual or suspicious transactional loan activity v. Any other alerts related to fraud or suspicious activity, as applicable Training for use and implementation of these resources is an ongoing process with emphasis on associative analysis and metrics base analytics is recommended. Training courses should include overview of AML requirements, OFAC program measures, and detailed review of Customer activity and behavior. Records of activity reviews, including copies of any correspondence and SAR’s should be retained in a central repository (such as a Client Relationship Manager), which provides record keeping at the account level. Any activity which is reviewed or investigated must be logged in the respective account record on the repository. Records of activity reviews should be held on file for no less than 5 five (5) years within the repository.. 15651.036 4822-7919-8312.10 15 XI. Customer Identification Program. As required by 31 CFR 1020.220, Third Party should maintain a written Customer Identification Program (CIP) designed to be appropriate for the size and type of business or product and intended to enable associates to form a reasonable belief that the true identity of each Customer is known. Third Party’s CIP should include required Customer information, risk-based procedures for verifying the identity of the Customer, recordkeeping requirements and retention, comparison with government lists, and adequate Customer notice. The CIP should be detailed in the Requirements and is subject to compliance by all associates with CIP responsibilities. The CIP should be reviewed and approved annually by the appropriate parties, in conjunction with oversight of Third Party’s AML Program. With respect to loans that establish an ongoing relationship with a Customer, Third Party shall review Customer information regarding each Customer, and shall be responsible for ensuring that each Customer meets the requirements of the CIP Program. Generally, the CIP program should adhere to the following structure for Customer accounts. The following Personally Identifiable Information (PII) should be collected and stored at the account level: i. Legal Name ii. Date of Birth

Detecting and Reporting Suspicious Activity. Associates have a duty to understand their responsibilities for detecting and reporting suspicious activity. It is the requirement of RCS Third Party that Associates follow established “Know Your Customer” (or KYC) procedures; that any customer, Associate, or other suspicious activity (or possible suspicious activity) be promptly reported to designated persons as set forth in the Requirements; that all such reports be timely and diligently investigated by such designated persons; and to timely and comprehensively fulfill all suspicious activity report filing requirements by providing proper notice to RCS Third Party BSA/AML Compliance Officer. Any suspicious activity identified by RCS Third Party should be reported to the Bank’s Non-Traditional BSA Manager or designated BSA Staff in a timely manner upon identification via the established agreed upon reporting mechanism. RCS Third Party shall require that all Associates should maintain the strict confidentiality of all such suspicious activity investigations and reports. In pursuit of its obligations to diligence and oversight, RCS Third Party should develop or acquire tools for use in reviewing account activity. These tools, when deployed in conjunction with a formal risk management training program should represent a broad spectrum approach to detecting and reporting suspicious activity. Per the Requirements, tools and resources should include the following: a. Daily application reviews of: i. Account applications at addresses with prior known fraud history [****] = CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENT, MARKED BY BRACKETS, HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION PURSUANT TO RULE 406 24B-2 OF THE SECURITIES EXCHANGE ACT OF 19331934, AS AMENDED. ii. Account application details, to include social security numbers, dates of birth and phone numbers, that may match prior established account with a history of suspect behavior iii. Account applications that appear to be associated with identified fraud rings iv. Unusual or suspicious transactional loan activity v. Any other alerts related to fraud or suspicious activity, as applicable Training for use and implementation of these resources is an ongoing process with emphasis on associative analysis and metrics base analytics is recommended. Training courses should include overview of AML requirements, OFAC program measures, and detailed review of Customer activity and behavior. Records of activity reviews, including copies of any correspondence and SAR’s should be retained in a central repository (such as a Client Relationship Manager), which provides record keeping at the account level. Any activity which is reviewed or investigated must be logged in the respective account record on the repository. Records of activity reviews should be held on file for no less than 5 years within the repository.