1557-0231 MLR Supporting Statement 8-30-22

Supporting Statement

Bank Secrecy Act/Money Laundering Risk Assessment

OMB Control No. 1557-0231

A. Justification.

1. Circumstances that make the collection necessary:

The OCC conducts an annual data collection, known as the Money Laundering Risk (MLR) System, from community banks (which include both national banks and federal savings associations) and trust banks to assist OCC examiners in supervising Bank Secrecy Act (BSA) and sanctions compliance. The MLR System enhances the ability of examiners and bank management to identify and evaluate BSA/money laundering and Office of Foreign Assets Control (OFAC) sanctions risks associated with banks’ products, services, customers, and geographies. The OCC is requesting to renew the MLR System community bank data collection.

In 2005, the OCC began to gather and analyze uniform information from OCC-supervised community banks under the MLR System. Information collected through the MLR System provides OCC examiners with the ability to identify higher-risk products, services, and customers for examination scoping, planning, and transaction testing. This information assists the OCC in allocating examination resources, improves examination scopes, augments transaction testing capabilities, and provides for enhanced and effective bank supervision. The data also provides the OCC with information regarding certain products or customers that may be experiencing difficulties maintaining banking services. Some banks use the data as a part of their own risk assessment processes.

2. Use of the information:

The OCC uses the information generated through the MLR System to evaluate and examine money laundering and terrorist financing risks associated with each bank’s products, services, customers, and geographies (PSCs), which have been updated for 2022. The OCC evaluates this information on a strategic level (i.e., across the population of all supervised banks), at the OCC district level, at the OCC supervisory office level, and on an individual bank basis. As new products and services are introduced, existing products and services change, and banks expand through mergers and acquisitions, banks’ evaluation of money laundering and terrorist financing risks is expected to evolve as well. The MLR System risk assessment allows the OCC to better identify those institutions, and business activities within institutions, that pose heightened risk and to allocate examination resources accordingly.

The OCC uses MLR System data on an annual and multiyear basis to evaluate BSA/money laundering and OFAC risks in individual banks. The OCC also provides bank-specific and anonymized peer group information gathered through the MLR system to each individual reporting bank. Peer group data can be used by banks to determine outliers, inconsistencies, or deviations from standard norms. Banks can also conduct comparison and trend analyses concerning their data and peer data.

3. Consideration of the use of improved information technology:

Banks that report information through the MLR System may use a variety of information technology formats that permit review by OCC examiners. The format of OCC’s annual Risk Summary Form (RSF) is fully automated, making data entry quick and efficient and providing an electronic record for banks and the OCC. Additionally, the MLR RSF system allows bankers to upload an XML file to complete the RSF. This XML file must comply with formatting style and validation requirements to be accepted into the OCC’s secure system. If the file is valid, the RSF is prepopulated with data ready to be submitted to the OCC.

4. Efforts to identify duplication:

The required information is unique, permits systemic analysis, is not duplicative or redundant, and is not collected in any other format from OCC-supervised institutions. Wire transaction and automated clearing house (ACH) data obtained from the Federal Reserve Banks for OCC-supervised institutions is not sufficiently granular for MLR purposes. Wire transaction data is limited to domestic wires only and does not include international wires, geographic locations, or whether the wires were sent Payable Upon Proper Identification. Similarly, ACH data is limited to domestic ACH data and does not include cross-border ACH or international ACH data or geographies. In addition, not all OCC-supervised institutions may initiate/send or receive international wires or ACH transactions through a Federal Reserve Bank.

5. If the collection of information impacts small businesses or other small entities, describe any methods used to minimize burden:

The OCC previously received feedback from community banks, many of which are small entities, that the burden for reporting MLR data is minimal and that reporting MLR data is not an onerous process. Most of the data requested for MLR purposes is readily available to banks and will not require substantial investment in technology or systems to collect and report. The OCC does not require the acquisition of additional software to collect and report MLR data. Many community banks collect and organize data on Excel spreadsheets using existing bank reports received on a daily, weekly, or monthly basis, as the reports become available throughout the reporting period. MLR data provided to the OCC generally derives from a bank’s own BSA risk assessment. Feedback received from banks reporting MLR data indicates that the MLR process has the positive impact of enhancing or confirming the accuracy of the bank’s risk assessment.

6. Consequences to the federal program if the collection were conducted less frequently:

The annual data collection cycle is closely related to the OCC’s statutory examination cycle requirements. In addition, conducting the MLR less frequently would be harmful to the OCC’s risk-based supervisory approach by making it more difficult to determine which banks pose the greatest BSA/money laundering and sanctions risk and thus making examinations less efficient. It would also impede community banks from being able to address appropriately their unique BSA/money laundering risks.

7. Special circumstances that would cause an information collection to be conducted in a manner inconsistent with 5 CFR part 1320:

The information collection will be conducted in a manner consistent with 5 CFR part 1320.

8. Efforts to consult with persons outside the agency:

On June 8, 2022, the OCC published a 60-day notice in the Federal Register concerning the collection, 87 FR 34927. The OCC received three comments from the public, including one from a banking association regarding the accuracy of the OCC’s information collection burden estimate and the impact the changes in the PSCs would have on the data collection process. One commenter stated the OCC did not provide a basis for its estimated burden of 7,760 hours from an estimated 970 respondents. The commenter asserted that the changes proposed to the MLR would require more than the eight hours per respondent estimated by the OCC, and the OCC had underestimated both the staff time and financial resources needed to update reporting systems to reflect the proposed changes. The respondent also commented that the introduction of six new products, services, customers, and geography categories (PSCs) and the resulting changes in the numbering and location of these PSCs would unnecessarily complicate the data collection process, require significant staff retraining and potentially result in mis-categorizations of the PSCs.

Systems currently maintained by most banks for MLR data collection purposes already support ready access to the data; thus, the changes to the MLR will not require additional significant investment in technology or systems to collect and report this data. The 7,760 hours in the OCC’s estimated burden already includes an additional two hours to account for the two new MLR PSCs. Based on these existing systems and the changes to the MLR platform described below, the addition of the two hours should be sufficient to account for any system changes banks may have to make in order to collect and report the data for the new PSCs. With planning and minor programming changes to banks’ systems, the additional MLR data collection burden associated with the proposed changes will be minimal for banks of all sizes.

The introduction of the six new PSCs and the resulting changes in the listing numeration of the PSCs is a minor modification and will not significantly impact the data collection and reporting process. Recently, the OCC made major changes to the MLR platform that have resulted in a more modern, intuitive, and user-friendly collection tool. The current data collection platform, and support resources offered by the OCC, will assist banks with the data collection process. In addition, the OCC offers annual webinars where any changes to the data collection process are presented and discussed with bankers. During the webinars, bankers are given time to ask questions related to this information collection. The changes to the MLR, introduced this year, will be discussed in detail during the 2022 MLR Webinar will give bankers additional opportunities to provide feedback. Moreover, each year, the OCC releases an updated MLR User Guide complete with detailed instructions on how the MLR data should be reported. Finally, the OCC has a dedicated MLR email inbox for bankers to submit MLR-related questions and receive timely assistance from the OCC.

9. Payment or gift to respondents:

None.

10. Any assurance of confidentiality:

The information will be kept private to the extent permitted by law.

11. Justification for questions of a sensitive nature:

There are no questions of a sensitive nature.

12. Burden estimate:

The OCC estimates the burden of this collection of information as follows:

Community Bank population (includes federal branches and agencies):

Estimated Number of Respondents: 970.
Estimated Number of Responses: 970.

Frequency of Response: Annually.
Estimated Annual Burden: 7,760 hours.

Total Estimated Annual Burden: 7,760 hours.

Cost of Total Estimated Annual Burden:

Total Estimated Annual Burden: 7,760 hours

Cost of Total Estimated Annual Burden: 7,760 hours x $119.63 = $928,328.80

To estimate wages the OCC reviewed May 2021 data for wages (by industry and occupation) from the U.S. Bureau of Labor Statistics (BLS) for credit intermediation and related activities (NAICS 5220A1).  To estimate compensation costs associated with the rule, the OCC uses $119.63 per hour, which is based on the average of the 90th percentile for six occupations adjusted for inflation (6.1 percent as of Q1 2022), plus an additional 32.8 percent for benefits (based on the percent of total compensation allocated to benefits as of Q4 2021 for NAICS 522: credit intermediation and related activities).

13. Estimate of total annual costs to respondents:

Not applicable.

14. Estimate of annualized costs to the Federal Government:

Not applicable.

15. Change in burden:

Former Burden: 6,528 hours.

Current Burden: 7,760 hours.

Difference: +1,232 hours.

While the community bank population decreased from a 2019 total of 1,088 to the current total of 970, the estimated time for the collection and reporting of data for the two new PSCs increased by two hours to the current eight hours, resulting in an overall increase in burden. As part of ongoing efforts to enhance the efficiency and effectiveness of BSA and anti-money laundering compliance, the OCC will continue working to develop an optimal framework for data collection from midsize and large bank populations and federal branches and agencies that will support OCC’s risk-based supervision.

16. Information regarding collections whose results are to be published for statistical use:

The OCC has no plans to publish the information for statistical purposes.

17. Reasons for not displaying OMB approval expiration date:

The OCC is not requesting permission to avoid displaying the OMB approval expiration date.

18. Exceptions to the certification statement:

None.

B. Collections of Information Employing Statistical Methods.

Not applicable.