Attached files

file filename
8-K - FORM 8-K - Discover Financial Servicesd742518d8k.htm

Exhibit 99.1

FEDERAL DEPOSIT INSURANCE CORPORATION

WASHINGTON, D.C.

 

 

      
  )     
In the Matter of   )    CONSENT ORDER  
  )     
DISCOVER BANK   )     
GREENWOOD, DELAWARE   )    FDIC-14-0133b  
  )     
(INSURED STATE NONMEMBER BANK)   )     

 

  )     

The Federal Deposit Insurance Corporation (“FDIC”) is the appropriate Federal banking agency for Discover Bank, Greenwood, Delaware (“Bank”), under section 3(q) of the Federal Deposit Insurance Act (“Act”), 12 U.S.C. § 1813(q).

The Bank, by and through its duly elected and acting Bank Board of Directors (“Board”), has executed a STIPULATION AND CONSENT TO THE ISSUANCE OF A CONSENT ORDER (“CONSENT AGREEMENT”), dated June 12,2014 that is accepted by the FDIC. With the CONSENT AGREEMENT, the Bank has consented, without admitting or denying any charges of unsafe or unsound banking practices or violations of law or regulation relating to weaknesses in the Bank’s Bank Secrecy Act (“BSA”) Compliance Program, to the issuance of this Consent Order (“ORDER”) by the FDIC.

Having determined that the requirements for issuance of an order under section 8(b) of the Act, 12 U.S.C. § 1818(b), have been satisfied, the FDIC hereby orders that:

BOARD SUPERVISION

1. The Board shall increase its supervision and direction of the Bank’s BSA Compliance Program. The supervision shall include holding meetings no less frequently than monthly, at


which it shall review and approve, as necessary, policies, procedures, and practices pertaining to BSA compliance, along with all respective committee minutes pertaining to these matters. The Board minutes shall document these reviews and approvals, including the names of any dissenting directors.

MANAGEMENT

2. The Bank shall have and retain management qualified to oversee all aspects of the Bank’s BSA Compliance Program. Management shall ensure compliance with all applicable laws and regulations. Each member of management shall have the qualifications and experience commensurate with his or her duties and responsibilities related to applicable laws and regulations.

BSA COMPLIANCE PROGRAM

3. (a) Within 120 days from the effective date of this ORDER, the Bank shall develop, adopt, and thereafter implement a revised, written BSA Compliance Program, including policies and procedures, which fully meets all applicable requirements of section 326.8 of the FDIC’s Rules and Regulations, 12 C.F.R. § 326.8, and which is designed to, among other things, ensure and maintain full compliance by the Bank with the BSA and the rules and regulations issued pursuant thereto.

(b) The Bank shall provide the Regional Director of the FDIC’s New York Regional Office (“Regional Director”) and the Office of the State Bank Commissioner of the State of Delaware (“Commissioner”) with a copy of the revised BSA Compliance Program for non-objection or comment. Thereafter, the revised BSA Compliance Program shall be implemented in a manner acceptable to the Regional Director and the Commissioner, as determined at subsequent examinations and/or visitations of the Bank.

 

2


BSA RISK ASSESSMENT

4. (a) Within 30 days from the effective date of this ORDER, the Bank shall retain a third-party consultant, acceptable to the Regional Director and the Commissioner, for the purpose of assisting the Bank in conducting a risk assessment of the Bank’s operations (“Risk Assessment”), consistent with the guidance for risk assessments set forth in the Bank Secrecy Act/Anti-Money Laundering Examination Manual compiled by the Federal Financial Institutions Examination Council (the “BSA Manual”). The Risk Assessment shall address all pertinent risk factors that affect the overall BSA/Anti-money laundering (“AML”) risk profile of the Bank across all of the Bank’s product lines, services, customers and transactions, and ensure that risk ratings are accurate and well supported through qualitative and quantitative data.

(b) Within 120 days after receipt of non-objection to the proposed third-party consultant from the Regional Director and the Commissioner, the Risk Assessment shall be presented to the Board, which shall review the Risk Assessment, and said review shall be recorded in the minutes of the Board, and the Bank shall develop appropriate written policies, procedures, and processes regarding Risk Assessments (“Risk Assessment Plan”) and present the Risk Assessment Plan to the Regional Director and the Commissioner for review, comment and non-objection. Within 15 days of receipt of non-objection from the Regional Director or Commissioner, the Bank shall incorporate any changes required by the Regional Director or Commissioner and thereafter adopt, implement, and adhere to the Risk Assessment Plan.

(c) Thereafter, the Bank shall conduct periodic Risk Assessments no less than annually.

 

3


OFAC RISK ASSESSMENT

5. (a) Within 30 days from the effective date of this ORDER, the Bank shall retain a third-party consultant, acceptable to the Regional Director and the Commissioner, for the purpose of assisting the Bank in conducting an Office of Foreign Assets Control (“OFAC”) risk assessment which provides a complete evaluation of the Bank’s OFAC risk (“OFAC Risk Assessment”), consistent with the guidance for OFAC risk assessments set forth in the BSA Manual. The OFAC Risk Assessment shall address all pertinent risk factors that affect the overall BSA/AML risk profile of the Bank across all of the Bank’s product lines, services, customers and transactions, and ensure that risk ratings are accurate and well supported through qualitative and quantitative data.

(b) Within 120 days after receipt of non-objection to the proposed third-party consultant from the Regional Director and the Commissioner, the OFAC Risk Assessment shall be presented to the Board, which shall review the OFAC Risk Assessment, and said review shall be recorded in the minutes of the Board, and the Bank shall develop appropriate written policies, procedures, and processes regarding OFAC Risk Assessments (“OFAC Risk Assessment Plan”) and present the OFAC Risk Assessment Plan to the Regional Director and the Commissioner for review, comment and non-objection. Within 15 days of receipt of non-objection from the Regional Director or Commissioner, the Bank shall incorporate any changes required by the Regional Director or Commissioner and thereafter adopt, implement, and adhere to the OFAC Risk Assessment Plan.

(c) Thereafter, the Bank shall conduct periodic OFAC Risk Assessments no less than annually.

 

4


BSA INTERNAL CONTROLS

6. (a) Within 120 days from the effective date of this ORDER, the Bank shall develop a revised system of internal controls designed to ensure full compliance with the BSA (“BSA Internal Controls”) taking into consideration the Bank’s size and risk profile, as determined by the Risk Assessment required by paragraph 4 of this ORDER.

(b) At a minimum, such system of BSA Internal Controls shall include policies, procedures, and processes addressing the following areas:

(i) Suspicious Activity Monitoring and Reporting: The Bank shall, taking into account its size and risk profile, revise, adopt and implement effective policies, procedures, processes, and systems for monitoring, detecting, and reporting suspicious activity being conducted in all areas within or through the Bank; and ensure the timely, accurate, and complete filing of Suspicious Activity Reports (“SARs”), with an appropriate level of documentation and support for management’s decisions to file or not to file a SAR, as required by law. These policies, procedures, processes and systems should ensure that all product lines, services, customers and transactions of the Bank are monitored for suspicious activity, including, but not limited to: credit card activity, consumer loans, private student loans, deposit and cash activity, monetary instruments, gift cards, international and domestic wire transfers, Automated Clearing House and ATM transactions. Any systems the Bank plans to utilize to assist in monitoring, detecting and reporting suspicious activity should be validated and parameters which are established should be supported through a documented analysis of appropriate information.

 

5


(ii) Due Diligence: The Bank shall review and enhance its customer due diligence (“CDD”) policies, procedures and processes for new and existing customers to:

a. be consistent with the guidance for CDD set forth in the BSA Manual; and

b. operate in conjunction With its Customer Identification Program (“CIP”);

(iii) At a minimum, the CDD program shall provide for:

a. a risk assessment of the customer base through an appropriate risk rating system to ensure that the risk level of the Bank’s customers is accurately identified based on the potential for money laundering or other illicit activity posed by the customer’s activities, with consideration given to the purpose of the account, the anticipated type and volume of account activity, types of products and services offered, and locations and markets served by the customer;

b. an appropriate level of ongoing monitoring commensurate with the risk level to ensure that the Bank can reasonably detect suspicious activity and accurately determine which customers require enhanced due diligence (“EDD”);

c. obtaining and analyzing a sufficient level of customer information at account opening to assist and support the risk ratings assigned;

 

6


d. a process for documenting and supporting the analysis conducted under the CDD process, including a process for validating risk ratings assigned at account opening, and resolving issues when insufficient or inaccurate information is obtained; and

e. a process to reasonably ensure the timely identification and accurate reporting of known or suspected criminal activity, as required by the suspicious activity reporting provisions of Part 353 of the FDIC’s Rules and Regulations, 12 C.F.R. Part 353.

(iv) Enhanced Customer Due Diligence: The Bank shall establish EDD policies, procedures and processes to conduct EDD necessary for those categories of customers the Bank has reason to believe pose a heightened risk of suspicious activity, including, but not limited to, high-risk accounts. The EDD policies, procedures and processes adopted should:

a. be consistent with the guidance for EDD set forth in the BSA Manual; and

b. operate in conjunction with its CIP and CDD policies, procedures and processes;

(v) At a minimum, the EDD program shall require EDD procedures to:

a. determine the appropriate frequency for conducting ongoing reviews, based on customer risk level;

b. determine the appropriate documentation necessary to conduct and support ongoing reviews and analyses in order to reasonably understand the normal and expected transactions of the customer; and

 

7


c. reasonably ensure the timely identification and accurate and complete reporting of known or suspected criminal activity against or involving the Bank to law enforcement and supervisory authorities, as required by the suspicious activity reporting provisions of Part 353 of the FDIC’s Rules and Regulations, 12 C.F.R. Part 353.

(vi) These policies, procedures, processes, and practices shall operate in conjunction with each other, and be consistent with the guidance for account/transaction monitoring and reporting set forth in the BSA Manual, including arranging for the dissemination of a high-risk customer list to appropriate departments within the Bank.

(c) The Board shall approve the revised system of internal controls, which approval shall be recorded in the minutes of the Board meeting. Thereafter, the Bank shall implement and fully comply with the revised system of internal controls.

OFAC SCREENING

7. Within 30 days from the effective date of this ORDER, the Bank shall implement an effective system to ensure that OFAC screening is conducted in a timely manner and is consistent with the guidance as set forth in the BSA Manual to ensure compliance with OFAC laws and regulations. The Bank shall ensure that periodic scans of its entire customer database are conducted against the Specially Designated Nationals (“SDN”) list, including ensuring that such scans are conducted after every update of the SDN list.

BSA INDEPENDENT TESTING

8. (a) Within 30 days from the effective date of this ORDER, the Bank shall revise, adopt and implement effective independent testing programs for compliance with the BSA and

 

8


OFAC rules and regulations, to be performed on no less than an annual basis. The scope of the testing procedures to be performed shall be documented in writing and approved by the Board or its designee. Testing procedures should be consistent with the guidance for independent testing as set forth in the BSA Manual and, at a minimum, address the following:

(i) overall integrity and effectiveness of the BSA Compliance Program, including policies, procedures, and processes;

(ii) BSA/AML risk assessment;

(iii) BSA reporting and recordkeeping requirements;

(iv) CIP implementation;

(v) adequacy of CDD and EDD policies, procedures, and processes and whether they comply with internal requirements;

(vi) personnel adherence to the Bank’s BSA/AML policies, procedures, and processes;

(vii) appropriate transaction testing, with particular emphasis on high-risk operations;

(viii) training adequacy, including its comprehensiveness, accuracy of materials, the training schedule, and attendance tracking;

(ix) an evaluation of management’s efforts to resolve violations and deficiencies noted in the previous tests or audits and regulatory examinations;

 

9


(x) an assessment of the overall process for identifying and reporting suspicious activity, including a review of filed or prepared SARs to determine their accuracy, timeliness, completeness, and effectiveness of the Bank’s SAR monitoring and reporting policies; and

(xi) accuracy and completeness of account risk profiles.

(b) Testing results shall be documented in a written report which shall provide recommendations for improvement, and be approved by the Board or its designee within 60 days of completion.

BSA AND OFAC OFFICER

9. (a) Within 30 days from the effective date of this ORDER, the Bank shall designate a qualified individual (“BSA Officer”) acceptable to the Regional Director and the Commissioner with delegated and requisite managerial authority, and an adequate level of appropriate resources to implement and enforce BSA compliance, including training, in all material respects with all BSA/AML laws and regulations. The BSA Officer’s qualifications should be commensurate with the complexity of the Bank’s activities and operations and the appointment of the BSA Officer shall conform with the guidance for the BSA officer position, as set forth in the BSA Manual. The BSA Officer’s sole responsibility shall be the administration of the Bank’s BSA Compliance Program. Bank employees who are responsible for performing BSA/AML monitoring and reporting activities shall report directly to the BSA Officer.

(b) Within 30 days from the effective date of this ORDER, the Bank shall designate a qualified individual acceptable to the Regional Director and the Commissioner with delegated

 

10


authority and requisite managerial authority to be responsible for coordinating and monitoring day-to-day compliance with the OFAC laws and regulations and the oversight of blocked funds (“OFAC Officer”) for review and non-objection by the Regional Director and the Commissioner. The OFAC Officer shall (i) have sufficient executive authority to monitor and ensure compliance with the OFAC laws and regulations; (ii) provide reports directly to the Board or the committee established pursuant to paragraph 15 of this ORDER; (iii) report to the Bank’s Audit Committee on a regular basis, not less than quarterly, with respect to OFAC matters; and (iv) be responsible for assuring the proper and timely filing of, reports of blocked or rejected transactions with OFAC and any other reports required by the OFAC laws and regulations.

(c) The designated BSA Officer and the OFAC Officer may be the same qualified individual.

BSA STAFFING

10. Within 30 days from the effective date of this ORDER, and periodically thereafter, no less than annually, the Bank will perform a review of its BSA staffing needs to ensure adequate and appropriate resources are in place at all times. The review should include, at a minimum, consideration of the Bank’s size and growth plans, geographical areas served, products and services offered, and any changes in the BSA Compliance Program or BSA and OFAC laws and regulations.

BSA TRAINING

11. (a) The Bank shall take all steps necessary, consistent with safe and sound banking practices, to ensure that all appropriate personnel are aware of, and can comply with, the requirements of the BSA applicable to the individual’s specific responsibilities to assure the Bank’s compliance with the BSA.

 

11


(b) Within 90 days from the effective date of this ORDER, the Bank shall revise, adopt and implement effective training programs designed for the Board, management and staff and their specific compliance responsibilities on all relevant aspects of laws, regulations, and Bank policies, procedures and processes relating to the BSA (“Training Program”). The Training Program shall ensure that all appropriate personnel are aware of, and can comply with, the requirements of the BSA on an ongoing basis, including as they relate to high-risk products and services. The Training Program shall, at a minimum, include:

(i) an overview of the BSA for new staff along with specific training designed for their specific duties and responsibilities upon hiring;

(ii) training on the Bank’s BSA policies, procedures and processes along with new rules and requirements as they arise for appropriate personnel designed to address their specific duties and responsibilities;

(iii) a requirement that the Bank fully document the training of each employee with respect to the BSA policies, procedures and processes, including the designated BSA Compliance Officer; and

(iv) a requirement that BSA training be conducted no less frequently than annually.

REPORTS

12. The Bank shall ensure that all required reports, including Currency Transaction Reports (“CTRs”), SARs, Reports of International Transportation of Currency or Monetary Instruments,

 

12


Reports of Foreign Bank and Financial Accounts, and any other similar or related reports required by law or regulation are completed accurately and properly filed within required timeframes.

LOOK BACK REVIEW

13. (a) Within 30 days from the effective date of this ORDER, the Bank shall engage a qualified firm, acceptable to the Regional Director and the Commissioner, to conduct a review of all accounts and transaction activity for the time period beginning June 30, 2012 through the effective date of this ORDER to determine whether suspicious activity involving any accounts or transactions within or through the Bank was properly identified and reported in accordance with the applicable suspicious activity reporting requirements (“Look Back Review”).

(b) Within 60 days of receipt of the Regional Director’s and Commissioner’s non-objection, the qualified firm shall commence the Look Back Review, and shall prepare any additional CTRs and SARs necessary based upon the review. Upon completion of the Look Back Review, the Bank shall submit the findings of the review and copies of any additional SARs and CTRs filed to the Regional Director and the Commissioner.

CORRECTIVE ACTION

14. The Bank shall take all steps necessary, consistent with other provisions of this ORDER and sound banking practices, to correct any unsafe or unsound banking practices and prevent any violations of law or regulation cited in the September 9, 2013 Report of Examination issued by the FDIC.

 

13


DIRECTORS’ BSA COMMITTEE

15. Within 30 days from the effective date of this ORDER, the Board shall establish a directors’ BSA Committee (“BSA Committee”) a majority of which members who are not an officer or an employee of the Bank, and whose composition is acceptable to the Regional Director and the Commissioner, with the responsibility of overseeing the Bank’s compliance with this ORDER, the BSA and OFAC laws and regulations and the Bank’s BSA Compliance Program. The BSA Committee shall receive comprehensive monthly reports from the BSA and OFAC Compliance Officer regarding the Bank’s compliance with BSA regulations and the Bank’s BSA Compliance Program. The BSA Committee shall present a report to the Board, at each regularly scheduled Board meeting, regarding the Bank’s compliance with BSA regulations and the Bank’s BSA Compliance Program, which shall be recorded in the appropriate minutes of the Board meeting and retained in the Bank’s records.

PROGRESS REPORTS

16. Within 45 days from the end of each calendar quarter following the effective date of this ORDER, the Bank shall furnish to the Regional Director and the Commissioner written progress reports detailing the form, manner, and results of any actions taken to secure compliance with this ORDER. All progress reports and other written responses to this ORDER shall be reviewed by the Board, and made a part of the Board minutes.

 

14


SHAREHOLDER DISCLOSURE

17. Within 30 days from the effective date of this ORDER, the Bank shall send a copy of this ORDER, or otherwise furnish a description of this ORDER, to its parent holding company. The description shall fully describe the ORDER in all material aspects.

MISCELLANEOUS

It is expressly understood that if, at any time, the Regional Director and the Commissioner shall deem it appropriate in fulfilling the responsibilities placed upon him under applicable law to undertake any further action affecting the Bank, nothing in this ORDER shall bar, estop, or otherwise prevent him or any other federal or state agency or department from taking any other action against the Bank or any of the Bank’s current or former institution-affiliated parties.

This ORDER shall be effective on the date of issuance.

The provisions of this ORDER shall be binding upon the Bank, its institution-affiliated parties, and any successors and assigns thereof.

The provisions of this ORDER shall remain effective and enforceable except to the extent that and until such time as any provision has been modified, terminated, suspended, or set aside by the FDIC.

 

15


Issued Pursuant to Delegated Authority

 

Dated: June 13, 2014
By:

/s/ John P. Conneely

John P. Conneely
Deputy Regional Director
New York Regional Office
Federal Deposit Insurance Corporation

 

16