Protiviti helps bank respond toregulatory action by performing independent BSA /AML model validationModel Risk and Capital Management – Financial Services

Client Challenge

A regional bank with approximately $20 billion in assets engaged Protiviti to validate its Bank Secrecy Act (BSA)/anti-money laundering (AML) and fraud monitoring models as part of its newly developed model validation plan and to comply with regulatory requirements. Our client had not performed model validations before and did not have the subject-matter expertise required to validate its models. In addition, our client was under a Matter Requiring Attention (MRA) from a regulatory body, which required an independent validation of all critical BSA/AML models.The bank selected Protiviti based on our experience validating BSA/AML models at other financial services institutions, and specifically because of our detailed approach using both quantitative and qualitative tools,which we use to perform independent model validations across our client base.

P O W E R F U L I N S I G H T SThe Protiviti team was tasked with a three-fold project:

• Help our client comply with the regulatory MRA notice.• Identify areas where model controls and processes could be enhanced.• Help develop our client’s competency and subject-matter expertise around model validation.

Our Model Validation experts reviewed client documentation and provided specific analytic testing and recommendations for the following model validation components:

• Modelgovernanceandchangecontrols – We assessed the adequacy of governance and changecontrol processes, roles and responsibilities; adequacy of model ownership; and performancemonitoring of models.

• Documentation– We reviewed the model validation framework, policies, procedures and standards.• Dataintegritycontrols – We assessed controls around information transfer to/from all relevant data

sources to the models.• Watchlistandnamematchingvalidation – We assessed the watch list filtering system validation

approach and methodology, as well as the filters utilized to screen the U.S. customer base.• Scenariovalidation – We assessed the scenario validation approach, including the creation of a

validation methodology; created scenario validation scripts to generate alerts or risk ratings; andvalidated the threshold values.

• Thresholdvalidation – We assessed the threshold-setting process and methodology, tested thestability of current thresholds, and validated the threshold values.

©2014 Protiviti Inc. An Equal Opportunity Employer. M/F/D/V. PRO-PKIC-0914-155Protiviti is not licensed or registered as a public accounting firm and does not issue opinions on financial statements or offer attestation services.

Contacts

ShaheenDilManaging Director and Practice Leader Model Risk and Capital Management +1.212.603.8378 shaheen.dil@protiviti.com

Chetan ShahAssociate DirectorAML/BSA Practice+1.704.972.9607chetan.shah@protiviti.com

About Protiviti

Protiviti (www.protiviti.com) is a global consulting firm that helps companies solve problems in finance, technology, operations, governance, risk and internal audit, and has served more than 40 percent of FORTUNE 1000® and FORTUNE Global 500® companies. Protiviti and its independently owned Member Firms serve clients through a network of more than 70 locations in over 20 countries. The firm also works with smaller, growing companies, including those looking to go public, as well as with government agencies.Protiviti is a wholly owned subsidiary of Robert Half (NYSE: RHI). Founded in 1948, Robert Half is a member of the S&P 500 index.

P R O V E N D E L I V E R YAt the completion of the project, we provided our client with a detailed report for each model, which included our understanding of the data inputs, data processing, controls and associated reporting, as well as a determination of whether each model uses reasonable assumptions, has controls that are appropriate in the current environment and is performing as expected. We discussed our findings with management, offered recommendations to improve model governance and performance, and proposed associated action plans and time frames for completion.The client shared this information with the bank’s regulators as evidence that it had completed a thorough and independent validation of its critical BSA/AML models, providing the requested response to the MRA notice. In addition, our work helped our client develop a better grasp of models and model validation, which gave it confidence in its discussions with the regulatory body.

How We Help Companies Succeed

Protiviti’s Model Risk professionals help management and boards of directors understand the value – and limitations – of their models so they can make confident business decisions, advance business strategies and maintain regulatory compliance.Models are simplified and idealized representations of the real world and are prone to errors in some cases. Further, because models are driven by assumptions and finite data inputs and then interpreted by people, model risk is inescapable. As a result, regulators and other stakeholders, such as auditors, investors and rating agencies, are demanding improved governance over the ever-expanding inventory of quantitative models.Our independent, holistic validation process helps companies control model risk, prevents losses associated with model risk and enhances key stakeholders’ understanding of models. We also help organizations manage their portfolios of model risks by assessing, designing and implementing model governance programs.