the account officer should avoid disclosing any details of the investigation to the customer, as this could compromise the integrity of the law enforcement inquiry, or even constitute tipping off, which is a criminal offense in many jurisdictions12. The account officer should only inform the customer that a legal request has been made, and that the bank is obliged to comply with it, without revealing the nature or scope of the request3. The account officer should also document the communication with the customer, and report it to the appropriate internal authority, such as the compliance officer or the legal department4.
References:
1: CAMS Study Guide, 6th Edition, Chapter 5: Compliance Standards for Anti-Money Laundering (AML) and Combating the Financing of Terrorism (CFT), page 151-152. 2: Tipping Off: What It Is and How to Avoid It, ACAMS Today, March 2019. 3: How to Handle Law Enforcement Requests, ACAMS Webinar, June
2018. 4: Best Practices for Responding to Law Enforcement Inquiries, ACAMS White Paper, October 2017.

The Office of Foreign Assets Control (OFAC) is a department of the U.S. Treasury that administers and enforces economic and trade sanctions based on U.S. foreign policy and national security goals1. OFAC regulations cover all persons and entities within the U.S., all U.S.-domiciled entities and their foreign branches, and all U.S. citizens, wherever located or employed2. These include U.S. banks, U.S. corporations,
U.S. subsidiaries of foreign corporations, U.S. residents, and U.S. citizens living or traveling abroad3. OFAC regulations do not cover foreign-based entities that have U.S. customers, unless they are owned or controlled by U.S. persons or entities4.
References: 1: Home | Office of Foreign Assets Control 2: eCFR :: 31 CFR Chapter V - Office of Foreign Assets Control, Department of the Treasury 3: FFIEC BSA/AML Office of Foreign Assets Control - Office of Foreign Assets Control 4: Office of Foreign Assets Control (OFAC): Definition, Sanctions

According to the Bank Secrecy Act (BSA), a financial institution or business must establish an anti-money laundering (AML) program that includes at least four elements: (a) a system of internal policies, procedures and controls to prevent, detect and report money laundering and other illicit activities; (b) a designated compliance officer who is responsible for overseeing the implementation and effectiveness of the AML program; an ongoing employee training program that covers the legal and regulatory obligations, the risks and red flags of money laundering, and the roles and responsibilities of the staff in the AML program; and (d) an independent audit function that tests and evaluates the adequacy and compliance of the AML program12.
While the Office of Foreign Assets Control (OFAC) is a key agency that enforces economic and trade sanctions against targeted foreign countries, entities and individuals, it is not part of the BSA or the AML program requirements. However, financial institutions and businesses are expected to comply with OFAC regulations and screen their customers and transactions against the OFAC lists of sanctioned parties. Failure to do so may result in civil or criminal penalties34. Therefore, it is advisable for financial institutions and businesses to have an OFAC program that is integrated with their AML program, but it is not a mandatory element that they have to specifically address in their AML program.
References:
1: Financial Crimes Enforcement Network (2020). Anti-Money Laundering Programs
2: ACAMS (2020). CAMS Certification Package (6th Edition)
3: Office of Foreign Assets Control (2023). Sanctions Programs and Country Information
4: Moses & Singer LLP (2023). Anti-Money Laundering, Bank Secrecy and OFAC Regulations

Customer composition and product offerings are two important factors that affect the level of risk exposure for a financial institution (FI) in terms of money laundering and terrorist financing. Customer composition refers to the types of customers that the FI serves, such as individuals, businesses, non-profit organizations, or politically exposed persons (PEPs). Different customer segments may pose different levels of risk depending on their activities, sources of funds, geographic locations, and connections to other entities. For example, customers that are cash-intensive, have complex ownership structures, operate in high-risk jurisdictions, or are associated with PEPs may present higher risk indicators than customers that are transparent, regulated, and operate in low-risk jurisdictions12. Product offerings refer to the types of products, services, and transactions that the FI provides, such as deposits, loans, wire transfers, trade finance, or digital assets. Different products, services, and transactions may have different levels of vulnerability to money laundering and terrorist financing depending on their features, complexity, volume, and speed. For example, products that are anonymous, involve high-value or cross-border transfers, enable rapid movement of funds, or involve new or emerging technologies may present higher risk indicators than products that are identifiable, involve low-value or domestic transfers, require multiple verification steps, or involve established or traditional technologies12.
References:
1: Risk Assessment: Risk Factors & Mitigating Measures2
2: Risk Assessment: Process, Examples, & Tools1