A BSA AML program for lenders outside banking is required today mainly of residential mortgage lenders and originators, which FinCEN treats as loan or finance companies. Their program must have risk-based controls, a compliance officer, training and independent testing, plus suspicious activity reporting. Bank statement reviews feed it by surfacing deposits that make no sense.
Which nonbank lenders need a BSA AML program?
The nonbank lenders that need a BSA AML program under FinCEN's rules are residential mortgage lenders and residential mortgage originators. FinCEN defines a "loan or finance company" to include them, and the program and reporting rules for that category apply. The definition does not currently list business lenders or merchant cash advance funders.
The definition sits in 31 CFR 1010.100(lll). Its only listed capacity is "residential mortgage lender or originator," and the paragraph after it is reserved. Within that capacity:
- A lender is the person to whom the debt from a residential mortgage loan is first payable.
- An originator is a person who accepts a residential mortgage loan application, or offers or negotiates the terms of one.
The originator half is the one that catches mortgage brokers. A broker that takes applications fits it, even though the broker never funds a loan. The definition also has exclusions. Banks are out, because they have their own program rule. So are individuals employed by a loan or finance company, which keeps the duty on the firm rather than on each loan officer. A person who finances the sale of their own home is not a lender for this purpose.
The practical test for a nonbank lender is simple. If it makes or originates residential mortgage loans, it needs a program. If it only funds business loans, equipment finance or merchant cash advances, FinCEN's loan company rule does not name it today. That is not the same as having no duties, which a later section covers.
The four required parts of a BSA AML program for mortgage lenders
A BSA AML program for mortgage lenders must be written and must have four parts: policies, procedures and internal controls based on a risk assessment; a designated compliance officer; ongoing training; and independent testing. The program must also bring the lender's agents and brokers into its scope.
The rule is 31 CFR 1029.210, and loan or finance companies had to comply by August 13, 2012. Each part has a specific job:
- Risk-based policies, procedures and internal controls. These start from the company's own assessment of its money laundering and terrorist financing risks. The rule says they must integrate the company's agents and brokers into the program, which means a lender that takes loans from outside brokers cannot leave those brokers out.
- A compliance officer. One person is responsible for running the program day to day, including watching agent and broker compliance, keeping the program current and making sure staff are trained.
- Training. Appropriate people get ongoing training. The lender can train them directly or confirm that a competent third party did.
- Independent testing. The program is tested on a scale that fits the company's risks. A third party can do it, or internal staff other than the compliance officer.
The risk assessment drives everything else. A wholesale lender that funds loans from dozens of brokers in many states has a different risk shape from a retail lender with one office and one product. The worksheet at the end of this post is one way to start that assessment.
Lenders that use rules or scoring models to flag unusual activity should treat those tools as models. Their thresholds and tuning need the validation and change control described in model risk management for underwriting.
When must a nonbank lender file a suspicious activity report?
A nonbank lender covered by the loan company rule must file a suspicious activity report when a transaction involves at least 5,000 dollars, alone or in aggregate, and the lender knows, suspects or has reason to suspect the activity is suspicious. The report is due within 30 days of initial detection.
The rule is 31 CFR 1029.320. It lists four kinds of suspicious transactions:
- Funds from illegal activity, or a transaction meant to hide such funds or evade federal law or reporting.
- A transaction designed to evade Bank Secrecy Act requirements, including by structuring.
- A transaction with no business or apparent lawful purpose, or one that is not the sort the customer would normally be expected to make, where the lender knows of no reasonable explanation after looking at the facts.
- A transaction that uses the company to facilitate criminal activity.
Deadlines and handling rules:
- 30 calendar days after initial detection of facts that may support a report.
- Up to 60 days in total if no suspect has been identified, to allow time to identify one.
- Immediate phone notice to law enforcement when a situation needs it, such as ongoing money laundering.
- Five years of retention for the report and its supporting documents, from the filing date.
- Confidentiality. A report, and any information that would reveal it exists, may not be disclosed except as the rule allows.
Confidentiality affects the borrower conversation. A lender that declines a file partly because of suspected fraud must still give a lawful adverse action notice, but it must not mention a report. When a borrower contests the decision, the reviewer follows the same limit, which is worth building into any underwriting decision appeal process.
Where bank statement reviews fit in a lender's BSA AML program
Bank statement reviews fit into a BSA AML program as a detection point. Underwriters already read months of a borrower's transactions to qualify income and assets. The same reading can show deposits with no clear source, patterns that look like structuring, or money passing through the account in ways that do not match the borrower's stated work.
Patterns worth sending to the compliance officer include:
- Cash deposits kept just under round figures across many days, with no business reason the borrower can explain.
- Large deposits from unrelated people or companies just before application, especially when they leave again soon after closing funds are verified.
- Funds that move in and straight out, where the account is a pass-through rather than a place money stays.
- Deposits inconsistent with the stated occupation, such as a salaried employee receiving frequent wires from abroad.
- Altered or inconsistent statements, where balances do not reconcile or a page's layout differs from the rest.
Not every odd deposit is suspicious. A sale of a car, a bonus or a family gift may explain a large credit. The underwriter's job is to ask for the explanation, as any large deposit review would, and to escalate when the explanation does not hold together. The compliance officer then decides whether a report is required.
Software helps the reading. TrueBankFlow flags large or out-of-pattern deposits, NSF fees and overdrafts with the date and statement line, and flags statements that fail a balance check instead of averaging them. It does not decide what is suspicious or file anything. That judgment stays with the lender's program.
BSA AML expectations for business lenders outside FinCEN's loan company rule
BSA AML expectations still reach business lenders and MCA funders that FinCEN's loan company rule does not name. Sanctions screening applies to every US person. Banks that hold a funder's accounts or provide its credit lines expect controls. And a lender that fails to notice obvious fraud carries credit losses whatever the regulatory label.
The duties that apply without a program rule:
- Sanctions. OFAC rules apply to all US persons, so every lender needs to screen borrowers, owners and guarantors. The OFAC screening for loans guide covers how and when.
- Bank partner terms. A funder's own bank may ask about its customer due diligence and monitoring as part of keeping the account.
- Fraud controls. The same statement patterns that matter for AML also signal fraud that hurts repayment.
A funder in this position often adopts a light version of the four-part program voluntarily: a named owner for financial crime risk, written escalation rules for underwriters, basic training and an annual review. That is a business choice, not a FinCEN requirement, but it gives the funder answers when a bank partner or investor asks.
A BSA AML risk assessment worksheet for a nonbank lender
A BSA AML risk assessment worksheet lists the lender's products, customers, channels and geographies, rates each for money laundering risk, and names the control that answers each rating. It is the document the rest of the program is built on, and the independent test will ask to see it.
The worksheet below is an example for an imagined nonbank mortgage lender. The ratings and controls are illustrative, not a recommended answer for any real company.
| Risk area | Example facts | Example rating | Example control |
|---|---|---|---|
| Products | Bank statement loans for self-employed borrowers | Higher | Second review of unsourced deposits above a set amount |
| Products | Agency purchase loans with W-2 income | Lower | Standard asset verification |
| Customers | Foreign national borrowers | Higher | Enhanced identity checks and source-of-funds documentation |
| Channels | Loans from outside brokers | Higher | Broker onboarding review and periodic file sampling |
| Channels | Retail loans from own staff | Lower | Training and quality control sampling |
| Geography | Properties in high-cost metro areas with frequent cash purchases | Medium | Review of funds-to-close sources |
| Transactions | Large wires into the account shortly before closing | Higher | Underwriter escalation to compliance officer |
Three habits keep a worksheet useful:
- Update it when the business changes, such as a new product or broker channel, not only once a year.
- Link each control to a person. A control nobody owns tends to stop happening.
- Keep the evidence. Training records, test results and escalation logs show the program works, which is what an examiner or tester checks.