Creating an Achievable Higher-Risk Banking Program: A Q&A

For many community banks and credit unions, higher-risk businesses and individuals already reside within your customer base, whether you acknowledge and plan for them or not, according to Kristin Parker, Director of Compliance at RiskScout. Understanding what it means to bank higher-risk customers and the steps for mitigating whatever risks are involved is what Parker addresses in the first part of this discussion.

Tune in next week for the second part of this Q&A in which Parker describes the practical steps for succeeding at higher-risk banking in terms of both employee and client education and technology tools.

Q: Financial risks are always evolving, of course. What are some of the higher-risk areas for today’s community banks and credit unions?

A: In every community throughout the United States, there are higher-risk businesses and individuals that are needing to be banked. They probably are being banked at your credit union or bank, and you don’t know they’re there.

Some of the biggest risks to financial institutions come from not properly knowing your customer base and being able to assess and mitigate the risks accordingly. That can be regulatory or reputational risks, too. One of the biggest problems we see at financial institutions is having a blanket statement saying, “We don’t bank anyone higher risk—at all,” and then a regulator comes in and finds loads of higher-risk clients.

It’s important to know who’s in your community-- or who’s within the footprint you’re banking, either in terms of businesses or individuals. That’s the biggest factor for properly assessing and mitigating the risks of banking [any higher-risk group].

Q: When it comes to defining “risk,” what distinguishes a high-risk banking program from a traditional one?

A: “Higher risk” simply means that the individual or business seeking financial services might present an elevated level of risk for potential illicit activity. Banking higher-risk clients means that your financial institution is responsible for meeting and adhering to the regulatory requirements defined by FinCEN and other regulatory agencies, including customer due diligence and enhanced due diligence.

Not everyone within a market or within certain higher-risk individual groups like non-resident aliens or politically exposed people will present the same type of risk. Someone may be thrown into a certain category because that’s the nature of their business or that’s the career they chose, if they’re politically exposed, and yet they don’t all present the same type of risk. It’s important to distinguish here. We don’t want to put out a blanket statement of risk for everybody.

For instance, saying “Everybody in the whole entire hemp community presents the same type of risk” is just not true. The risks are different if you’re a grower or a retailer or a processor. So it’s important to emphasize that “higher risk” doesn’t necessarily mean that they’ll be risky for your institution to bank.

Q: Would you discuss an example of building a high-risk banking program and some steps that could be taken to lessen the overall risk involved?

A: There are varying types of higher-risk banking programs. They go from traditional higher-risk banking, which would include industries that have been around for a long time like your money-services businesses, or privately- or independently-owned ATMs, or cash-intensive businesses like convenience stores.

Then you have the opposite. You have institutions taking advantage of newer or emerging markets, such as banking fintechs, banking hemp and CBD, and banking cryptocurrency. Regardless of whether it’s a traditional or emerging market, the process is really the same in how you go about building a program to successfully mitigate risk. Your first step is always understanding who’s in your footprint. In other words, is there really a market for this?

Once you determine the demographics and the opportunity, that’s when you can start the phase of talking to your key stakeholders, including your board of directors, your regulators, and your subject matter experts, to understand what’s involved in banking this type of individual or business.

Once you truly have an understanding of what the perceived or known risks are for banking those individuals or businesses, that’s when you can sit down and start a risk assessment. And that risk assessment needs to be designed specifically for the industry. It shouldn’t just be your traditional BSA risk assessment. It should be one that’s specific to the nuances that happen within this type of higher-risk market. After the completion of the risk assessment, you’ll have the information you need to be able to build your business case for executive management to determine if banking these types of higher-risk business or individuals is the right move for your institution.

If it is determined by the Board of Directors and other key stakeholders that the higher-risk banking program is approved to move forward, the work of building robust policies, procedures and processes begins. At this point it is typically best to reach out to other FIs or subject matter experts that have gone down this path before to learn best practices and lessons learned for launching and maintaining a higher-risk banking program.

Q: What’s involved in a risk assessment for higher-risk customers?

A: If you’re banking hemp and CBD, you should have an assessment that’s designed to underst