Contract
Exhibit 10.1 AGREEMENT BY AND BETWEEN | |
CommunityBank of Texas, N.A. | |
Beaumont, Texas | |
and | AA-SO-2020-40 |
The Office of the Comptroller of the Currency |
XxxxxxxxxXxxx xx Xxxxx, X.X., Xxxxxxxx, Xxxxx (“Bank”) and the Office of the Comptroller of the Currency (“OCC”) wish to assure the safety and soundness of the Bank and its compliance with laws and regulations.
The Comptroller of the Currency (“Comptroller”) has identified deficiencies relating to the Bank’s compliance with Bank Secrecy Act/anti-money laundering (“BSA/AML”) laws and regulations, including a violation of 12 C.F.R. § 21.21(d)(1) (Internal Control Pillar) and other violations;
Therefore, the OCC, through the duly authorized representative of the Comptroller, and the Bank, through its duly elected and acting Board of Directors (“Board”), hereby agree that the Bank shall operate at all times in compliance with the following:
ARTICLE I
JURISDICTION
COMPLIANCE COMMITTEE
(1) Within thirty (30) days of the date of this Agreement, the Board shall appoint a Compliance Committee of at least three (3) members of which a majority shall be directors who are not employees or officers of the Bank or any of its subsidiaries or affiliates. The Board shall submit in writing to the Assistant Deputy Comptroller the names of the members of the Compliance Committee within ten (10) days of their appointment. In the event of a change of the membership, the Board shall submit in writing to the Assistant Deputy Comptroller within ten (10) days the name of any new or resigning committee member. The Compliance Committee shall monitor and oversee the Bank’s compliance with the provisions of this Agreement. The Compliance Committee shall meet at least quarterly and maintain minutes of its meetings.
(2)By July 31, 2020, and thereafter within thirty (30) days after the end of each quarter, the Compliance Committee shall submit to the Board a written progress report setting forth in detail:
(a) | a description of the corrective actions needed to achieve compliance with each Article of this Agreement; |
(b) | the specific corrective actions undertaken to comply with each Article of this Agreement; and |
(c) | the results and status of the corrective actions. |
2
(3)Upon receiving each written progress report, the Board shall forward a copy of the report, with any additional comments by the Board, to the Assistant Deputy Comptroller within ten (10) days of the first Board meeting following the Board’s receipt of such report.
ARTICLE III
BSA OFFICER AND STAFF
(a) | The BSA/AML Department organizational structure for independent lines of authority and clearly define the roles and responsibilities of staff and the BSA Officer; |
(b) | the adequacy of staffing of the BSA/AML compliance function, including, |
(i) | the level and scope of responsibilities of the BSA Officer; |
3
(ii) | the knowledge, skills, and capabilities of the BSA Officer to conduct assigned responsibilities and ensure the Bank’s compliance with requirements of the BSA; and |
(iii) | the number, qualifications, and experience of staff needed to support the BSA Officer and the Bank’s BSA/AML compliance function, and the level and scope of responsibilities of any support staff; |
(c) | the BSA Officer’s reporting structure, stature, authority, time and resources; and |
(d) | the Bank’s performance evaluation program that addresses periodic performance evaluations of staff involved with BSA/AML compliance. |
4
ARTICLE IV
BSA INTERNAL CONTROLS
(a) | procedures for periodically updating the Bank’s BSA risk assessment to cover risks associated with current, or subsequently proposed Bank products, services, transaction types, customers, entities, and geographies served, and including the dollar volume associated with Bank products, services, customers and transactions; |
(b) | procedures to perform mapping of the BSA/AML monitoring systems to ensure all accounts and transactions are captured for suspicious activity monitoring; |
(c) | procedures to ensure the usage of appropriate thresholds in the Bank’s automated monitoring systems to filter accounts and customers for further monitoring, review, and analysis including: |
(i) | an analysis of the filtering thresholds established by the Bank; |
(ii) | periodic testing and monitoring of thresholds for their appropriateness to the Bank’s customer base, products, services, and geographic areas; |
(iii) | a requirement that any changes to thresholds are approved by the appropriate Bank committee and periodically reported to the Board, or a designated committee thereof; |
(iv) | a requirement that documentation of any changes to the filtering thresholds is maintained and available to auditors and OCC examiners; |
(d) | procedures for periodic (no less than annually) independent validation of the models and filtering thresholds used for the BSA monitoring systems by conducting above and below the line testing and documenting results in order to ensure that all accounts and transactions are captured, and the systems are adequate to detect potentially suspicious activity; |
(e) | well-defined policies and procedures for investigating and responding to transactions that have been identified as posing greater than normal risk for compliance with the BSA, including timely, well-documented disposition of alerts generated by the automated monitoring systems; |
(f) | adequate controls and procedures to ensure the adequate and timely filing of currency transaction reports (“CTRs”) and suspicious activity reports (“SARs”); and |
(g) | procedures for performing Customer Due Diligence (“CDD”) as detailed in Article V of this Agreement. |
6
ARTICLE V
CUSTOMER DUE DILIGENCE, ENHANCED DUE DILIGENCE, AND CUSTOMER RISK IDENTIFICATION PROGRAMS
(a) | the collection of additional information for high-risk customers and/or products and services, including, but not limited to, expected activity prior to onboarding such high-risk customers. Refer to the Suspicious Activity Reporting section of OCC Bulletin 2014-60, “Revised FFIEC BSA/AML Examination Manual” (“FFIEC BSA/AML Examination Manual”), for guidance; |
(b) | conducting ongoing monitoring for customer information to reflect changes in the customer’s behavior, activity profile, derogatory |
information, or other factors that impact the BSA/AML risk score for the customer; |
(c) | collecting additional information on high-risk customers when additional information is not present in the customers’ files; |
(d) | a methodology for identifying additional information requirements when sufficient information is not present in customer files to enable the Bank to understand the nature and purpose of the customer relationship; |
(e) | a risk rating methodology to differentiate between lower- and higher-risk customers based on sufficient BSA/AML risk factors, including the type and volume of transaction activity, geographies involved, and suspicious activity monitoring alert and filing history, among others; |
(f) | processes for conducting and documenting EDD on high-risk accounts, including ongoing monitoring expectations. The EDD standards must provide Bank management with a sufficient understanding of anticipated high-risk customer transactions; |
(g) | periodic review of customer activities by type and volume. The purpose of these reviews is to determine if the customer's activity is reasonable, CDD information is current and complete, and the customer risk rating is accurate. Quality assurance processes must evaluate the accuracy and comprehensiveness of review documentation. Standards and processes shall be established for elevating reviews for additional management consideration regarding increased monitoring, additional due diligence or account closure; |
(h) | periodic reports on all high-risk customers that include: |
(i) | an assessment of the customer’s operations, BSA/AML risks, and BSA/AML controls; |
(ii) | critical analysis of all information in the file, including the identification of significant disparities, investigation and documentation of high-risk indicators or potentially suspicious activity, and well-supported conclusions; |
(iii) | a comparison of expected, historical, and current activity; |
(iv) | documentation to support management’s analysis of why the flow of funds is consistent with the expected activity for the customer and the accounts are being used as intended; and |
(v) | supporting documentation used in the analysis, including any specific transaction reviewed or investigated. |
(i) | specification of the EDD information that Bank staff must obtain for high-risk accounts, which among other information shall include: |
(i) | narrative description of the business operations of complex customer relationships, such as those with multiple business activities including obtaining and analyzing financial information to understand the source of funds and reasonableness of account activity; |
(ii) | analysis of and conclusions on different types of customer account activity, such as cash transactions and wire activity, in addition to aggregate account activity; and |
9
(iii) | criterion which prompts site visits and financial statements reviews, along with expectations of the scope, frequency, and documentation of said visits and financial statement reviews. |
ARTICLE VI
BSA/AML AUTOMATED MONITORING SYSTEM
10
(a) | the integrity of the data input into the suspicious activity monitoring system, including documentation of the methodology used, the input sources tested, and other information as necessary; |
(b) | the system has been sufficiently tailored to the Bank's risk profile and operations; |
(c) | the system functionality is being appropriately utilized to address risk or an explanation for not using functionality is documented in the Bank's policies and procedures; |
(d) | the business logic units, parameters, rules or other factors selected for the automated monitoring system are appropriate and effective in identifying customer activity that is unreasonable or abnormal given the nature of the customer's occupation or business and expected activity. In addition, there shall be: |
(i) | sufficient management information and metrics to manage and adjust the system, as necessary including identification of |
employees responsible for completing SARs, suspect information, the date the suspicious activity was detected, alert date, alert determination, investigation received date, time from alert to investigation, the filing deadline, the actual date of filing, and the date the SAR was reported to Bank management and/or governance committees; |
(ii) | sufficient management information and metrics to manage and adjust the system and surveillance processes, and statistically valid processes to validate and optimize monitoring system settings and thresholds, and to measure the effectiveness of the automated system and individual scenarios, where appropriate; |
(e) | independent validation of alert triggers, parameters, and other settings. Refer to OCC Bulletin 2011-12, "Supervisory Guidance on Model Risk Management" for guidance; |
(i) | data inputs from all products, services, and transactions; |
(ii) | evaluating the criteria for identifying potential suspicious activity in all of these areas to ensure it is effective, appropriate, and comprehensive in the characteristics used; |
(iii) | evaluating the appropriateness of thresholds in criteria used to identify potential suspicious activity by conducting above-the-line and below-the-line testing and documentation; |
(iv) | testing that potentially suspicious activity that meets the criteria for identifying potential suspicious activity correctly generates alerts |
as intended; |
(v) | documentation of filtering criteria and thresholds and the appropriateness of these criteria and thresholds; and |
(vi) | ensuring that all relevant BSA/AML staff is aware of the criteria included in the suspicious activity monitoring system’s rules. |
(a) | use of an alert scoring methodology to prioritize workflows and facilitate management of the system; |
(b) | the adequacy of qualified staffing to investigate and clear alerts; |
(c) | the accurate and complete information available to analysts working transaction monitoring alerts and conducting investigations; |
(d) | the standards for disposition of different types of alerts are reasonable, communicated in writing to relevant staff, and are adhered to by the alert investigators; |
(e) | adequate documentation is maintained to support the disposition of alerts including the evaluation of source and use of funds and identification of red flags and inconsistencies in activity; |
(f) | methods to obtain additional information to investigate potentially suspicious activity including, if applicable, information from multiple lines of business a customer transacts with; |
(g) | disposition of each alert within a reasonable time period after the generation of the alert and the filing of SARs and follow-up SARs |
within timeframes specified in applicable rules and regulations; |
(h) | process to track requests for information including tracking the original submission and response, and documenting inadequate and untimely responses; |
(i) | standards that ensure accounts with high volumes of alerts are identified, elevated and properly categorized as high risk, and subject to EDD and monitoring; |
(j) | policies and procedures to outline which customer accounts are exempt from the alert investigation processes, with a documented rationale for the exemption; |
(k) | effective and sustainable quality control processes designed to ensure the surveillance and transaction monitoring system, alert management processes, and SAR decisioning and filing are working effectively and according to internal standards, and include all lines of business; |
(l) | any backlogs in the suspicious activity monitoring and reporting processes are promptly reported to Bank management, in writing, for resolution; and |
(m) | the effectiveness of training for staff involved in the investigation and clearing alerts, filing of SARs, quality control and assurance processes, and management of the automated suspicious activity monitoring system. |
ARTICLE VII
14
BSA/AML AUDIT
(a) | test the adequacy of internal controls and determine compliance with the BSA and its implementing regulations; |
(b) | connect the audit risk assessment to audit work performed; |
(c) | provide adequate coverage of all relevant areas of the Bank; |
(d) | detect irregularities in the Bank’s operations; |
(e) | clearly communicate the audit scope and controls to be tested; |
(f) | perform sufficient transaction testing in areas of higher-risk or concern; |
(g) | evaluate the Bank's adherence to established policies, procedures and risk tolerance; |
(h) | validate the Bank’s automated system filters and thresholds for appropriateness and accuracy; |
(i) | perform an appropriate level of transaction testing to support audit findings and conclusions. Transaction testing methodology must be documented in work papers by including the identification of control population, sample size, sampling methodology, how the control will be tested, and what constitutes a successful test; and |
(j) | clearly identify audit findings, risk rating findings, identify the root cause of findings and require prompt substantive Bank management response |
that addresses the identified root cause and follow-up to audit exceptions or findings. |
16
ARTICLE VIII
BSA/AML TRAINING
(a) | provide for more extensive BSA training for all Board members and operational and supervisory personnel assigned to the Bank’s BSA compliance function. Training shall specifically address higher risk customers, any new expanded products, services, or customers; |
(b) | provide for targeted training for other personnel focusing on the individual’s specific duties and responsibilities; and |
(c) | include strategies for mandatory attendance, the frequency of training, procedures and timing for updating the training program and materials, |
and the method for delivering training and procedures to ensure employee training completion is tracked and documented. |
ARTICLE IX
SUSPICIOUS ACTIVITY REVIEW “LOOKBACK’
18
(a) | a summary of the number and types of customers and accounts reviewed; |
(b) | the number of customers and accounts requiring additional investigation; |
(c) | the number of customers that warranted SAR filings or modifications of existing SAR filings; and |
(d) | the number of customers where the Bank determined not to file a SAR. |
ARTICLE X
GENERAL BOARD RESPONSIBILITIES
19
(a) | authorize, direct, and adopt corrective actions on behalf of the Bank as may be necessary to perform the obligations and undertakings imposed on the Board by this Agreement; |
(b) | ensure that the Bank has sufficient processes, management, personnel, control systems, and corporate and risk governance to implement and adhere to all provisions of this Agreement; |
(c) | require that Bank management and personnel have sufficient training and authority to execute their duties and responsibilities pertaining to or resulting from this Agreement; |
(d) | hold Bank management and personnel accountable for executing their duties and responsibilities pertaining to or resulting from this Agreement; |
(e) | require appropriate, adequate, and timely reporting to the Board by Bank management of corrective actions directed by the Board to be taken under the terms of this Agreement; and |
(f) | address any noncompliance with corrective actions in a timely and appropriate manner. |
ARTICLE XI
OTHER PROVISIONS
(a) | pursuant to 12 C.F.R. § 5.3(g)(5), the Bank may be treated as an “eligible bank” for the purposes of 12 C.F.R. Part 5, subject to the requirements contained in 12 C.F.R. § 5.3(g)(1)-(4); |
20
(b) | pursuant to 12 C.F.R. § 5.51(c)(7)(ii), the Bank is not subject to the restrictions in 12 C.F.R. § 5.51 requiring prior notice to the OCC of changes in directors and senior executive officers or the limitations on golden parachute payments set forth in 12 C.F.R. Part 359, subject to the requirements contained in 12 C.F.R. § 5.51(c)(7)(i), (iii); and |
(c) | pursuant to 12 C.F.R. § 24.2(e)(4), the Bank may be treated as an “eligible bank” for the purposes of 12 C.F.R. Part 24, subject to the requirements contained in 12 C.F.R. § 24(e)(1)-(3). |
ARTICLE XII
Assistant Deputy Comptroller
Office of the Comptroller of the Currency
Houston Field Xxxxxx
0000 XxXxxxxx Xxxxxx, Xxxxx 0000
Xxxxxxx, Xxxxx 00000-0000
(7)The terms of this Agreement, including this paragraph, are not subject to amendment or modification by any extraneous expression, prior agreements, or prior arrangements between the parties, whether oral or written.
IN TESTIMONY WHEREOF, the undersigned, authorized by the Comptroller as his duly authorized representative, has hereunto set his signature on behalf of the Comptroller.
/s/ Xxxxx Xxxxxxxxxx |
Xxxxx Xxxxxxxxxx |
Assistant Deputy Comptroller |
Houston Field Office |
IN TESTIMONY WHEREOF, the undersigned, as the duly elected and acting Board of Directors of CommunityBank of Texas, N.A. have hereunto set their signatures on behalf of the Bank.
/s/ Xxxx Xxxxxxx | June 17, 2020 | |
Xxxx Xxxxxxx | Date |
23
/s/ Xxxxx X. Xxxxxx | June 17, 2020 | |
Xxxxx X. Xxxxxx | Date | |
/s/ Xxxx Xxxxx | June 17, 2020 | |
Xxxx Xxxxx | Date | |
/s/ Xxxx Xxxxxxxx | June 17, 2020 | |
Xxxx Xxxxxxxx | Date | |
/s/ Xxxxxx X. Xxxxxxxx, Xx. | June 17, 2020 | |
Xxxxxx X. Xxxxxxxx, Xx. | Date | |
/s/ Xxxxxxx Xxxxxx | June 17, 2020 | |
Xxxxxxx Xxxxxx | Date | |
/s/ Xxxxxxx Xxxxx, Xx. | June 17, 2020 | |
Xxxxxxx Xxxxx, Xx. | Date | |
/s/ Xxxxxx Xxxxxxx | June 17, 2020 | |
Xxxxxx Xxxxxxx | Date | |
/s/ Xxxxxx Xxxxxx | June 17, 2020 | |
Xxxxxx Xxxxxx | Date | |
/s/ Xxxxx XxXxxxxxxx | June 17, 2020 | |
Xxxxx XxXxxxxxxx | Date | |
/s/ Xxxxx Xxxxxx | June 17, 2020 | |
Xxxxx Xxxxxx | Date |
24
/s/ J. Xxx Xxxxxxx | June 17, 2020 | |
J. Xxx Xxxxxxx | Date | |
/s/ Xxx Xxxxxxx, Xx. | June 17, 2020 | |
Xxx Xxxxxxx, Xx. | Date | |
/s/ Xxxx X. Xxxxxxx, III | June 17, 2020 | |
Xxxx X. Xxxxxxx, III | Date | |
/s/ Xxxxxx Xxxxx | June 17, 2020 | |
Xxxxxx Xxxxx | Date | |
/s/ Xxxxxx X. Xxxxxxxx | June 17, 2020 | |
Xxxxxx X. Xxxxxxxx | Date | |
/s/ Xxxx Xxxxxxx | June 17, 2020 | |
Xxxx Xxxxxxx | Date | |
/s/ Xxxxxx Xxxxxxxx | June 17, 2020 | |
Xxxxxx Xxxxxxxx | Date | |
/s/ Xxxx Xxxxx Xxxxxxxx | June 17, 2020 | |
Xxxx Xxxxx Xxxxxxxx | Date | |
/s/ W.E. Xxxx Xxxxxx, Jr. | June 17, 2020 | |
W.E. Xxxx Xxxxxx, Jr. | Date | |
/s/ Xxxx X. Xxxxxx | June 17, 0000 | |
Xxxx X. Xxxxxx | Date | |
/s/ Xxxxx X. Xxxx | June 17, 2020 | |
Xxxxx X. Xxxx | Date |
25