Auditing Elder Financial Exploitation: Minding Your

Own Business or Making It a Part of Your Business

Terri P. Sands, CAMS, At-Risk Adult Crime Tactics (ACT) Specialist, AAP

2

TABLE OF CONTENTS

Executive Summary .............................................................................................................................................. 3

Background ........................................................................................................................................................... 3

Regulatory Guidance and Expectations ................................................................................................................ 5

Mandated Reporters and Protected Individuals ................................................................................................... 5

Auditing the Financial Institution’s Elder Financial Exploitation Program ........................................................... 6

Risk Assessment ............................................................................................................................................... 7

Program Governance ........................................................................................................................................ 7

Board Reporting and Escalation ................................................................................................................... 8

Policies and Procedures ................................................................................................................................ 8

Elder Financial Exploitation Policies and Procedures Audit Checklist .......................................................... 9

Internal Controls............................................................................................................................................. 10

Systems ...................................................................................................................................................... 10

Elder Financial Exploitation Internal Control Audit Checklist..................................................................... 11

Training .......................................................................................................................................................... 12

Elder Financial Exploitation Training Audit Checklist ................................................................................. 14

Independent Testing ...................................................................................................................................... 16

Strategic Focus on Emerging Risks ................................................................................................................... 16

Conclusion .......................................................................................................................................................... 17

Resources and References ................................................................................................................................ 18

Glossary of Terms .............................................................................................................................................. 19

3

Executive Summary

At the crossroads of privacy and mandated reporting of elder financial exploitation, financial

institutions sometimes struggle with their obligation to detect, respond and report this type

of suspicious activity. The sensitivity of trying to stop possible elder financial exploitation

when the senior woman or man knowingly gives funds to a caregiver or family relative, may

be met with hesitation and discomfort. Employees and management at financial institutions

may feel their involvement is intrusive and unnecessary because the senior communicates

their intent to provide cash in large amounts to a caregiver, family member or in some cases

strangers. The act of a seniorsimply “knowing” about his/her surrendering of funds may be

interpreted as permission for the financial institution to move forward with a transaction that

in turn may lead to elder financial exploitation and in some cases physical abuse and the

death of the elderly woman or man. In a January 2015, True Link Financial Report’s research

revealed that seniors lose $36.48 billion each year to elder financial abuse. The research

further reflected that approximately 36.9 percent of seniors are affected by financial abuse

in a given five year period. 1 The common denominator of seniors is they have scheduled

monthly social security payments, have the majority of the wealth and are easily identified.

Without a structured program and an effective audit plan for elder abuse prevention and

detection, financial institutions may unknowingly open the door to reputational risk in cases

where elder abuse occurs on their watch, was undetected and becomes public.

The purpose of this white paper is to furnish best business practices for independent testing

on validating the effectiveness of the program, provide awareness of the growing problem

and significance of a financial institutions’ involvement and highlight regulatory

expectations and guidance. Best business practices are based on experience, trial and error,

known elder financial exploitation cases and today’s regulatory expectations.

Background

Financial institutions are often times the center of elder financial exploitation based on the

inherent nature of their business purpose: the trusted custodian of the funds and assets.

Knowingly or unknowingly, financial institutions face the problem of elder financial

exploitation by default through the ordinary course of business including cashing checks,

originating and receiving ACH and wires, withdrawing funds from an ATM, use of the debit

card at a point of sale terminal and even the approval of a loan or reverse mortgage.

Financial exploitation defined is when a person misuses or takes the assets of a vulnerable

adult for his/her own personal benefit. This frequently occurs without the knowledge or

consent of a senior or disabled adult, depriving him/her of vital financial resources for

1 "The True Link Report on Elder Financial Abuse 2015." The True Link. True Link Financial, Jan. 2015. Web.

4

his/her personal needs.2 As previously stated, it is important to note that seniors are also

exploited even when they have provided consent, as often times they feel pressured or

confused about how their funds will be used.

A factor that makes elder financial exploitation even more significant is that it is personal

and global. Whether it is a mother, father, grandmother, grandfather, distant relative or

family friend, people generally know an individual who is a senior, knows of an attempt of

financial exploitation of a senior or is aware of an actual crime that has occurred resulting

in monetary loss and mental anguish of an elderly individual.

Psychological manipulation of the elder population can originate from two different groups—

known relationships or strangers. Seniors or incapacitated or mentally challenged adults

may be tricked at the expense of those individuals that are in a position to be trusted

(“trusted entities”). Examples of this group may include a son, child, grandchild or a

caregiver. The common denominator is that this group is highly trusted and can easily

manipulate the elder adult into surrendering a portion or the entire value of his/her life

savings. The term “undue influence” is often used to describe when a person in a position

of trust takes advantage of a vulnerable adult to gain control of their money, property, or

their life—either directly or through a power of attorney (POA), a trust, marriage, adoption or

inheritance.3

Strangers represent the second group. This group normally preys on the elderly by promising

goods, services or other benefits that are nonexistent, unnecessary, or never intended to be

provided or misrepresented. An example of this would be the Jamaican lottery scheme that

is comprised of Jamaican fraudsters tricking seniors into believing they won the lottery. The

senior receives a FedEx or UPS package with the instructions to claim his/her prize in an

attempt to legitimize the winning. The senior is provided instructions on how to claim his/her

prize. The instructions include a request to pay a processing fee. Once the senior pays the

processing fee, there are often additional fees that the fraudster is claiming the senior owes

which further perpetrates the fraud and results in significant amounts of funds being

withdrawn and paid out to the criminals. Seniors are often targeted for this reason and then

in turn are tricked into becoming money mules for the purpose of using their account for the

movement of fraudulent funds. This could result in money laundering up to other criminal

activities. A money mule or sometimes referred to as a "smurfer" is a person who transfers

money acquired illegally (e.g., stolen) in person, through a courier service, or electronically,

on behalf of others. The mule is paid for their services, typically a small part of the money

2 "What Is Financial Exploitation?" National Adult Protective Services Association. N.p., n.d. Web.

3 "Practical Law." N.p., n.d. Web. .

5

transferred.4 Whether through known relationships or strangers, the crime is real and

negatively impacts the victims.

Regulatory Guidance and Expectations

In March 2016, the Consumer Financial Protection Bureau published an Advisory for

Financial Institutions on Preventing and Responding to Elder Financial Exploitation.5 The

increased scrutiny of this type of crime can be seen through these types of advisory notices

and regulatory expectations trickling down to warn financial institutions to be prepared.

Preparedness means that regulators want to see program structure, proof of training and

also proof that the program is effective. The financial institution’s audit program is

fundamental to evidence the effectiveness of such program.

Mandated Reporters and Protected Individuals

One important point that sometimes gets overlooked is that financial institution employees

are mandated reporters. A mandated reporter refers to “an individual required by law to

report suspected or confirmed abuse.”6 A mandated reporter may range from an employee

of a financial institution to a health care facility which is defined by state law. An example

of a mandated reporter in the state of Maryland is defined as:

“Notwithstanding any law on privileged communications, each health care practitioner, police officer,

or human service worker who contacts, examines, attends, or treats an alleged vulnerable adult.

Notwithstanding any other law limiting or prohibiting disclosure, a fiduciary institution shall make an

abuse report as provided in this subsection if an employee of the fiduciary institution, while acting

within the scope of the employee’s employment: (i) has direct contact with an elder adult or reviews

or approves an elder adult’s financial documents, records, or transactions in connection with

financial services provided by the fiduciary institution to or for the elder adult; and (iii) observes or

obtains knowledge of behavior or unusual circumstances or transactions that leads the employee to

know or have reasonable cause to suspect that the elder adult is the victim of financial abuse.” 7

As mandated reporters vary by state, the definition of protected individuals also differs by

state. A protected individual while defined by each state is generally characterized as any

person that would be vulnerable to elder financial exploitation and is protected by law. An

4 “Money Mule.” Wilkamedia Foundation, n.d. Web. 5 "Advisory for Financial Institutions on Preventing and ..." Consumer Financial Protection Bureau. N.p., n.d. Web.

6 "A Profile of Older Americans: 2015 - Aoa.gov." N.p., n.d. Web.

7 "Maryland Reporting Requirements Chart." N.p., n.d. Web.

6

example of a protected individual in the state of Georgia includes two types of protected

individuals as provided below:

Disabled adult: a person 18 years of age or older who is not a resident of a long term care facility

as defined in Article 4 of Chapter 8 of Title 31, but who is mentally or physically incapacitated or

has Alzheimer’s disease, as defined in Code Section 31-8—180, or dementia, as defined in Code

Section 49-6-72. G.A. Code. 8

Elder Person: a person 65 years of age or older who is not a resident of a long-term care facility

as defined Article 4 of Chapter 8 of Title 31. G.A. Code.9

A part of a financial institution’s audit program is to understand the mandatory reporting

requirements for the elderly and/or vulnerable persons. Mandated reporter information is

used when reporting an elder financial exploitation case with the states’ Department of

Aging Services and when filing a suspicious activity report. This list can be obtained by

contacting your states’ Department of Aging Services or accessing Mandatory Reporting

Requirements for Elderly and/or Vulnerable Persons.10 NOTE: This list may not have updated

information so it is important to contact your state directly for specific reporting

requirements.

Auditing the Financial Institution’s Elder Financial Exploitation Program

When auditing the effectiveness of an elder financial exploitation program, a financial

institution should understand and document the requirements of mandated reporters,

protected individuals by state, and key controls that are necessary to mitigate the risks

associated with elder financial exploitation. It is essential to ensure the BSA/AML program

includes documentation to support the financial institution’s compliance practices for

mitigating elder financial exploitation. Proof of compliance is dependent on a documented

risk assessment, program governance, strong internal controls, training, independent testing

and a designated BSA/AML officer that is responsible for the program and the assurance

that training for all applicable personnel is completed timely and tracked.

8 "2010 Georgia Code: TITLE 30 - HANDICAPPED PERSONS: CHAPTER 5 - PROTECTION OF DISABLED ADULTS AND ELDER

PERSONS: § 30-5-8 - Criminal Offenses and Penalties." Justia Law. N.p., n.d.. Web 9 "Read "Elder Mistreatment: Abuse, Neglect, and Exploitation in an Aging America" at NAP.edu." Appendix B: Analysis of Elder Abuse and Neglect Definitions under State Law. N.p., n.d. Web.

10 "Http://www.napsa-now.org/wp-content/uploads/2014/11/Mandatory-Reporting-Chart-Updated-FINAL.pdf."

Http://www.napsa-now.org/wp-content/uploads/2014/11/Mandatory-Reporting-Chart-Updated-FINAL.pdf. N.p., n.d. Web.

7

Risk Assessment

The risk assessment is an integral part of complying with regulatory guidance. Elder

financial exploitation is a current risk for fraud and any fraud vulnerable area is also

susceptible to money laundering. It is important to recognize elder financial exploitation as

potentially high risk and document this type of risk and the financial institution’s risk controls

into the risk assessment. This shows the transparency of the BSA/AML program and

highlights the financial institution’s ability to appropriately mitigate and manage the

emerging risk of elder financial exploitation.

As part of the BSA/AML risk assessment, the financial institution should include signs of

potentially high-risk activities and controls used to mitigate these risks. Below is a chart that

provides signs of elder financial exploitation. The financial institution should also track

additional emerging indicators specific to their program and include it as part of their

ongoing risk management procedures.

Signs of

Financial

Exploitation

(include but

are not

limited to):

Accompanied by a stranger to the bank who encourages them to withdraw large

amounts of cash

Accompanied by a family member or other person who seems to coerce them

into making transactions

Client not allowed to speak for themselves or make decisions

Implausible explanation about what they are doing with their money

Concerned or confused about "missing" funds in their accounts

Neglected or receiving insufficient care given their needs of financial status

Isolated from others, even family members

Unable to remember financial transactions or signing paperwork

Program Governance

Program governance of the elder financial exploitation program should include the

appropriate oversight, management and ongoing review of the effectiveness of the program.

To ensure the financial institution can demonstrate the effectiveness of such a program, it

is important to have documented policies and procedures in place that are approved by the

designated committee such as the board of directors. In addition, it is important to ensure

the financial institution has a structured program that includes a method for measuring,

monitoring and reporting elder financial exploitation. A strong BSA/AML program is the

ability to demonstrate a compliance of culture and a tone at the top with reporting directly

to the board of directors.

8

Board Reporting and Escalation

As part of a strong BSA/AML program is the ability to demonstrate a compliance of culture

and a tone at the top with reporting directly to the board of directors. As proof of this

compliance, it is important to have effective reporting and escalation procedures that are in

place andclearly defined that outlines the depth of risks and mitigating controls. Specific to

the elder financial exploitation program, the following areas should be covered:

Trending information on suspicious activity reports filed for elder financial

exploitation;

Periodic trending of elder financial exploitation cases;

Periodic trending of dollars unable to recover (monetary loss of elder financial

exploitation);

Carving out and reporting significant elder financial exploitation events;

Identification of high-risk trends (i.e., spikes in strangers targeting elders, spikes in

elder financial exploitation based on debit card use);

Current regulatory guidance, new state and/or federal laws, rules and regulations

that apply to elder financial exploitation and any roadblocks that may impede the

financial institution’s ability to mitigating and/or prevent this crime.

As part of the financial institution’s ability to report the effectiveness of the elder financial

exploitation program to the board of directors, it is important to have a case management

system that provides a clear and trackable method for identifying, measuring, monitoring,

and reporting to the board of directors or designated committee.

Policies and Procedures

As a requirement of the FFIEC Guidance on BSA/AML,11 policy and procedures are at the

core of defending the compliance program. Policies and procedures are important to create

structure, organizational discipline and ongoing compliance with regulatory expectations.

Below is a an audit checklist that outlines sample policy and procedure content, description

of what should be documented and testing criteria used to validate the documentation

compared to business practices and determine discrepancies:

11 FFIEC Guidance on BSA/AML. N.p., n.d.

9

Elder Financial Exploitation Policies and Procedures Audit Checklist

Policy and

Procedures

Content

Content Description Documentation compared to Business Practice

Purpose of Policy

andProcedures

The purpose of the elder financial

exploitation policy and procedures is to

ensure it reflects the need to identify,

prevent and report elder financial

exploitation.

Review policy and procedures documentation to

ensure the intent of the policy and procedures are

clear and readily understandable by all applicable

parties. Also ensure the board of directors or

designated group has approved the policy and

procedures.

Age Based on

State Law

State law defines protected individuals

that should be reflected in policy.

Review policy and procedures documentation and

compare to system settings and training material to

ensure the state law age matches what is in the

policy and procedures.

Roles

andResponsibilities

Roles and responsibilities should include

all applicable areas responsible for

adhering to the policy and procedures.

Review policy and procedures documentation to

ensure roles and responsibilities are clearly reflected

and talk to those individuals to determine if they

understand their roles and responsibilities as

documented in the policy/procedures.

System Controls

System controls should be outlined in the

policy and procedures as those key areas

that are relied upon for the identification,

prevention and reporting of elder financial

exploitation.

Review policy and procedures to ensure system

controls match what is documented. Review relied

upon systems and controls that are documented and

interview management/employees to validate these

controls are known and followed.

Reporting

Protocols

Reporting protocols should be documented

to reflect how the financial institution

reports the elder financial exploitation to

the appropriate agencies such as

Department of Aging Services and law

enforcement. Reporting protocols should

also be documented for escalations within

the financial institution for the purpose of

further reporting possible suspicious

activity.

Review policy and procedures to ensure reporting

protocols are documented. Obtain a reported elder

financial exploitation event and determine if that

reporting protocol matches that documented in the

policy/procedures and review those suspicious

activity reports to determine if the documentation

reflects the extent of the elder financial exploitation

event.

Compliance

Requirements

Policy and procedures should include

regulatory guidance, laws such as

Regulation E requirements and the

Gramm-Leach-Bliley Act that reflects the

financial institution’s obligation to comply.

Review policy and procedures to ensure that the

appropriate regulatory guidance and laws are clearly

documented and that training of these requirements

are conducted for applicable staff.

Training

Requirements

Review policy and procedures to ensure the

training requirements for the financial

institution are documented.

Review policy and procedures to ensure training

requirements are documented and determine if all

applicable areas of the financial institution are

required to take the elder financial exploitation

training (this can be elder financial exploitation

training by itself or as part of other types of training

such as security training/BSA/AML training).

10

Internal Controls

Internal controls as required by BSA/AML FFIEC Guidance focuses on various aspects of the

elder financial exploitation program including controls such as policies and procedures,

sufficient controls for identifying and reporting suspicious activity, and internal policy

guidelines. The guidance further recommends that “internal controls should be

commensurate with the structure, risks and complexity of the bank.”12

This section will focus on methods for auditing internal controls such as system

effectiveness.

Systems

As this type of crime has increased, an important factor for preventing elder financial

exploitation is the ability to differentiate between normal activity and unusual and possibly

suspicious activity. Specific to elder financial exploitation, an important key control is the

ability to identify elder financial exploitation patterns and abnormal transactional behavior

in your BSA/AML and/or fraud system and ensuring the system is effectively optimized to

mitigate the risks of an overabundance of false alerts.

The best business practice for elder financial exploitation prevention is the identification of

abnormal behavior based on the activity in the account. Transactional monitoring has

varying validation rules including static and neural rules.

Static rules, sometimes referred to as peer group analysis are built on specific scenarios that

represent possible suspicious activity based on the entirety of the peer group in question.

An example would be setting the system to generate an alert for all account holders 65 years

of age and older that have a wire activity greater than one transaction, cash out greater than

$500 and based on a 30-day time period.

Neural rules sometimes referred to as intelligence-based rules monitor for transactional

patterns based on the individuals normal transactional history. An example would be an alert

generated for excessive withdrawal of funds based on debit card usage or sending an

international wire when the customer does not have the history of performing such

transactions. Neural rules provide a more robust and meaningful monitoring method based

on its ability to identify suspicious activity specific to the individual rather than a one-size-

fits-all monitoring based on peer group analysis.

12 "Online Manual - BSA InfoBase - FFIEC." Online Manual - BSA InfoBase - FFIEC. N.p., n.d. Web.

11

It is important to note that not all monitoring systems have the same flexibility so it is

necessary to understand how the monitoring system works and then determine the

effectiveness of the system based on true possible suspicious activity that have been

identified, researched and possibly filed as a suspicious activity report. Financial institutions

and other organizations that have a significantly greater population of the elderly may wish

to have software that is solely dedicated to this type of monitoring. If you are auditing this

type of outsourced system, the same criteria may be used as cited below. It is up to the

financial institution to ensure their systems are effective. Dependency on third party systems

does not remove a financial institution’s liability. An example of evaluating the effectiveness

of the system(s) used to identify possible elder financial exploitation is below:

Elder Financial Exploitation Internal Control Audit Checklist

Criteria

Criteria Verification

System/Process Testing Examples

Age of Individual

Should be based on the financial

institution’s state requirements for

protected persons or earlier (i.e., if the

protected individual is 65+ in age, the

parameters should be set at a minimum

on the age 65 or maybe even younger

based on experience of unusual activity).

Review parameters of the system to determine if there

is a discrepancy between the age criteria on the system

compared to the age of protected individuals by state

requirements. If the age is greater than that of the

required age of the protected person by state, this

would be an exception and should be documented.

Transactional

Should be set and tested based on

meaningful criteria (age, cash-out and

dollar amounts of cash out)

Review the transactional worklists criteria to identify

possible elder financial exploitation such as:

Age

Cash-out from checks cashed

Activity inconsistent with elder’s ability such as

ATM use by a physically impaired person

Excessive new withdrawals, usually in round

numbers ($50, $100, $1,000, $5,000,

withdrawals made from savings or CD’s in spite

of penalty assessments, changing in authorized

signers)

One way to test the effectiveness of a system is to

identify elder financial exploitation reported outside of

the system by employees and determine why the system

did not identify this transactional suspicious activity. In

some situations, the financial institution’s monitoring

systems have not been optimized to turn on the elder

financial exploitation module and therefore the auditor

can determine that the financial institution is not trained

on this type of crime or has not taken the appropriate

steps to mitigate elder financial exploitation.

Products/Services

Should be set and tested based on

meaningful criteria (products/services

such as international wires that are not

Review the system settings to determine how

products/services that are not utilized by elder adults

would be identified as possible suspicious activity. One

way to test the effectiveness of a system is to identify

12

Criteria

Criteria Verification

System/Process Testing Examples

frequently used by customers 65 or

older).

elder financial exploitation reported outside of the

system by employees and determine why the system did

not identify the unusual act of using certain

products/services such as:

Outgoing international wires

Reversed mortgages

Remote check deposits

Ordering of debit cards

Request for online banking services after certain

number of months/years of having an account)

In some situations, the financial institution’s monitoring

systems have not been optimized to turn on the elder

financial exploitation module and therefore the auditor

can determine that the financial institution is not trained

on this type of crime or has not taken the appropriate

steps to mitigate elder financial exploitation.

Suspicious

Activity Filing

The financial institutions monitoring

system should be set appropriately to

effectively identify and capture possible

elder financial exploitation.

System Testing: The auditor could pull the last elder

financial exploitation cases that were identified outside

of the system (i.e., by employees of the financial

institution) and determine if the system identified the

event or missed the event based on system settings. The

auditor should also validate that the SAR reflects elder

financial exploitation. On February 22, 2011, FinCEN

issued an advisory to financial institutions on filing

suspicious activity. This advisory focused on red flags or

indicators that abuse may be occurring and specifically

asked financial institutions to include the term "Elder

Financial Exploitation" on filings of suspicious activity

reports (SARs).13

SARs Filed vs. SARs not Filed: Review suspicious activity

that was filed and not filed to determine if there is a

discrepancy between those events that rose to the level

of filing and ones that did not. Ask the BSA officer the

reason for those filed versus those not filed to determine

if there is a discrepancy in decisions to fileand not file a

SAR.

Training

In 2015, I conducted a training for a group of financial institutions on elder financial

exploitation. In this group, one of the attendees communicated that her bank had never had

to deal with elder financial exploitation and stated that “her bank was lucky to have avoided

this type of crime.”.Four months later, the same financial institution contacted me regarding

how to engage law enforcement as this had become a significant issue at her bank. She

13 "FinCEN Advisory Warns of Elder Financial Exploitation." FinCEN Advisory Warns of Elder Financial Exploitation. N.p.,

n.d. Web.

13

admitted that it was not that her bank had been lucky; it was that her bank had not been

trained on how to identify elder financial exploitation.

Training is an important pillar to be used as proof of compliance and important in the

financial institutions ability to mitigate the risks of this type of criminal activity. As the

BSA/AML Guidance states, “At a minimum, the bank’s training program must be conducted

for all personnel whose duties require knowledge of BSA. The training should be tailored to

the person’s responsibilities.”14 There are generally five types of training to consider when

building a strong elder financial exploitation training program:

Beginning/General Purpose Elder Financial Exploitation Training – General purpose elder

financial exploitation training serves as the commitment by the financial institution for

providing awareness of elder financial exploitation, how this

crime can be identified by employees, examples of elder

financial exploitation in financial institutions and escalation

procedures of the financial institutions.

Job Family Specific Training for Higher Risk Impacted Areas -

This training would build upon the general purpose elder

financial exploitation training and provides specifics on

methods used to identify elder financial exploitation in higher risk areas of the financial

institution that would be more susceptible to this type of crime.

Board of Directors Training (Inclusion of Elder Financial Exploitation) – This training would

entail specific training that educates the board of directors on the threats of this

emerging risk and how the financial institution is mitigating this type of risk. Since elder

financial exploitation is an emerging risk, it is a best business practice to highlight to the

board of directors any spikes in elder financial exploitation activity and discuss how the

financial institution plans to mitigate its risk (i.e., change in system parameters, training

the branch locations, trust departments). Financial institutions should ensure that the

board of directors are apprised of the FinCEN Advisory on elder financial exploitation as

a category for filing SARs and educated on this regulatory guidance.15

Elder Adult Account Holders, Caregivers and Community Training – This type of training

focuses on community outreach. The purpose of this training is to not scare elder adults

but bring awareness to the senior citizen community and caregivers regarding financial

14 "BA/AML Compliance Program — Overview." Online Manual. N.p., n.d. Web.

15 "FinCEN Advisory Warns of Elder Financial Exploitation." FinCEN Advisory Warns of Elder Financial Exploitation. N.p.,

n.d. Web.

14

exploitation and how to prevent this type of event. An effective method would be to

conduct training at nursing homes, extended care facilities, and other senior citizen

events that could bring awareness to this group regarding the identification of financial

exploitation and the methods to report this type of crime. Often times, financial

institutions partner with local law enforcement groups to jointly conduct these types of

training. Financial institutions that create special training brochures, documentation,

and/or videos may consider reaching out to their regulatory partners to determine if this

could be counted toward the financial institution’s Community Reinvestment Credits.

The Community Reinvestment Act (CRA) is intended to encourage depository institutions

to help meet the credit needs of the communities in which they operate, including low-

income and moderate-income neighborhoods, consistent with safe and sound banking

operations.16

Important Network Collaboration and Training - Law Enforcement, Department of Aging

Services and Network Training and Collaboration – In August 2016, the Consumer

Financial Protection Bureau published a Resource Guide for Elder Financial Exploitation

Prevention and Response Networks.17 This guide provides the industry with resources on

current networks and provides direction on how groups can collaborate and begin a

network to bring more concentrated efforts to prevent this type of crime. Financial

institutions could use this guide to determine how they could create peer networks for

the exchange of information, strengthen their own internal program and collaborate with

law enforcement, department of aging and other like groups to create a more unified

prevention program.

Elder Financial Exploitation Training Audit Checklist

Type of Training

Training testing examples

General Purpose

Obtain training documentation that includes elder financial exploitation from the

BSA/AML officer or designated individual responsible for this type of training. This

may be a part of the BSA/AML training or conducted as a separate training. Training

could be conducted online or in-person. Determine if the general training includes

at a minimum the following: a clear definition of elder financial exploitation,

mitigation tools for preventing elder financial exploitation and a protocol for

reporting this type of activity. This should include any employee that has any

dealings/interactions with account holders.

Job Specific Training

Obtain training documentation that includes elder financial exploitation from the

BSA/AML Officer or designated individual responsible for this type of training. This

may be a part of the BSA/AML training or conducted as a separate training. Training

could be conducted online or in person. Determine if the job-specific training

16 FFIEC Guidance on BSA/AML N.p., n.d. Web.

17 "A Resource Guide for Elder Financial Exploitation ..." N.p., n.d. Web.

15

Type of Training

Training testing examples

includes at a minimum the following: a clear definition of elder financial

exploitation, mitigation tools for preventing elder financial exploitation, a protocol

for reporting this type of activity and job specific “red flag” events specific to the job

family that would rise to the level of escalation. Examples may include but not

limited to:

Electronic Banking/Operations - This training should include specific “red flag”

events/examples of identifying elder financial exploitation such as outgoing

international wire transfer for 85-year-old accountholder that does not align

with his/her normal activity. This training should include the escalation point

for these types of events.

Information Security– This training should include specific “red flag’

events/examples of identifying elder financial exploitation from access into

online banking systems such as IP addresses that may lead to unauthorized

access of an elderly adult account. This training should include the escalation

point for these types of events.

Branch/Retail Services– This training should include specific “red flag”

events/examples of identifying elder financial exploitation such as an 85-year-

old account holder cashing a check for $7,000 who never withdrew that amount

of cash in the past. This training should include the escalation point for these

types of events.

Lending/Mortgage Services – An individual wishing to get a loan in an amount

that does not align with his/her normal activity or wishes to get a reverse

mortgage. This training should include the escalation point for these types of

events.

Wealth/Trust Services/Private Banking– An individual having abnormal activity

including a withdrawal of funds from trust or private banking accounts. This

training should include the escalation point for these types of events.

Call centers – A senior customer requesting to activate online banking services,

unusual calls for balance in the account, a person contacting the call center and

handing the phone to the senior individual for authorization to provide

information. This training should include the escalation point for these types of

events.

Compliance/Risk Management/Audit Staff– Compliance/audit/risk

management staff should be trained on the importance of governing the

oversight of the elder financial exploitation program, consumer complaints

regarding elder financial exploitation and ensuring these key personnel are

trained on this emerging risk.

Elder Adult Account

Holders, Caregivers

and Community

Training

Obtain documentation that reflects training conducted for elder account holders,

caregivers and the community. Determine the type of training conducted to ensure

the effectiveness of the training (i.e., online training may not be as effective for

seniors than in-person training). Determine if training was conducted in

partnerships with law enforcement, department of aging services, nursing homes,

and/or assisted living establishments. Also, determine if the training may include

too much of a “scare” tactic rather than a supportive type approach. This training

should include information on where to report this type of activity.

Important Network

Collaboration and

Training - Law

Enforcement,

Department of Aging

Services and

Network Training and

Collaboration

Discuss with the BSA/AML officer or designated staff to determine how the financial

institutions works with key groups such as law enforcement, Department of Aging

Services, and other networks. Without this type of network training, it may be

difficult for the financial institution to know how to report this type of crime and

have a sustainable and structured program.

16

Independent Testing

Independent testing is an important pillar to evidence the effectiveness of a financial

institution’s BSA/AML compliance program. It is important as part of the financial

institutions’ vendor management efforts to choose an audit program that is independent,

conducted by experienced individuals with the right credentials and qualifications and

incorporates the validation of emerging risks such as elder financial exploitation. There is a

difference between regulatory guidance and regulatory expectations. While a financial

institution may be able to demonstrate compliance with documented regulatory guidance,

the struggle is defending regulatory expectations. In the area of elder financial exploitation,

there is a trend in the increase of interagency guidance, advisory notices and increased

threats which results in the expectation of the financial institution to beef up its internal

controls, training and independent testing.

To effectively support the effectiveness of such a program, the financial institution is

expected to demonstrate its ability to measure the results. The ability to defend the program

boils down to proving the overall effectiveness of internal controls, training, independent

testing and the actions taken by the BSA/AML officer to mitigate elder financial exploitation.

Strategic Focus on Emerging Risks

In some cases, financial institutions strategically wait to get the nudge from regulators to

implement a new program until they are forced to implement a program based on regulatory

recommendations, negatively impacted elder customers and/or consumer complaints. A

regulatory expectation is for financial institutions to pay close attention to emerging risks as

these risks could negatively impact a financial institution’s ability to handle new threats or

future compliance requirements. Although elder financial exploitation is not a new threat, it

is a serious crime that has gained significant attention over the years based on escalated

fraud and significant monetary losses, more elderly individuals speaking out on their

experiences, media interest and the attention of the regulatory community.

A compelling risk of financial exploitation is two-fold—the ability to drain an elderly

individual’s savings and potentially exploiting the elder adult to facilitate another crime such

as human trafficking. In human trafficking, there are generally three phases including

recruitment, transportation and exploitation.18 The exploitation phase includes funding the

human trafficking criminal activity and therefore criminals could use a vulnerable senior to

facilitate such a crime. This could be achieved by a criminal manipulating a vulnerable senior

to initiate a wire transfer destined to a beneficiary in a city along the Southwest border to

18 "FinCEN Advisory: Financial Red Flags for Human Smuggling and Human trafficking”

17

fund the crime. In the normal course of business, a financial institution may not consider

this type of activity suspicious; however, human trafficking could be concealed behind the

financial exploitation of the elder adult. In an ACAMS white paper written by Nancy E. Lake

titled Human Trafficking in the Community Bank,19 it states “We in the anti-money

laundering (AML) may never be personally impacted by criminal activity, but we know that

monies from numerous crimes pass through the FIs on a daily basis, regardless of their size.”

The failure to keep up with industry threats and emerging criminal trends could be

significantly damaging to a financial institution’s reputation and its ability to comply with

U.S. law.

Conclusion

The purpose of this paper is to provide the reader a best business practice for auditing an

elder financial exploitation program and to bring awareness of the seriousness of elder

financial exploitation that impacts millions of victims each year—some reported and others

undetected. The failure of a financial institution to have a program in place for detecting

elder financial exploitation through a documented risk assessment, governance, policies

and procedures, effective systems, trained employees, and structured processes presents

significant risks and further intensifies the problem. Failure of an independent audit to test

the effectiveness of the elder financial exploitation program discounts the problem and

silently suggests that elder financial exploitation is not something the financial institution

has taken seriously and/or made part of its business.

The perfect storm or as a criminal would consider a perfect situation is when a financial

institution fails to identify, prevent and report this crime. The third line of defense is a critical

part of ensuring vulnerable areas are appropriately tested and validated for effectiveness. I

encourage readers to use this paper as a best business practice model for auditing and/or

reviewing their current elder financial exploitation program, documenting gaps and bringing

awareness to business owners and the community. When you interview your business

owner(s) and request information on the last elder financial exploitation event and they do

not have one to provide, this will be your que that the financial institution has some work to

do in this area. Auditors can serve as partners for not only documenting the gaps in the

program but being an active participant in the fight against this horrific crime.

19 Lake, Nancy. "Human Trafficking in the Community Bank." – This paper was published by the Association of Certified Anti-Money Laundering Association (ACAMS).

18

Resources and References

Regulatory Guidance

Regulatory Agency Guidance, Letters and Advisory’s Website

FDIC

Federal Regulators Issue Guidance

on Reporting Financial Abuse of Older Adults

https://www.fdic.gov/news/news/press/2013/pr13084.html

OCC

Federal Regulators Issue Guidance on Reporting Financial Abuse of

Older Adults

https://www.fdic.gov/news/news/press/2013/pr13084.html

NCUA

NCUA Letter to CUs out on elder financial abuse -

http://www.nafcu.org/News/2013_News/September/NCUA_Letter_to_CUs_out_on_elder_financial_abuse/

Federal Reserve Bank

Federal Regulators Issue Guidance on Reporting Financial Abuse of

Older Adults

http://www.federalreserve.gov/newsevents/press/bcreg/20130924a.htm

FinCEN

Advisory to Financial Institutions on Filing Suspicious Activity Reports

Regarding Elder Financial Exploitation

https://www.fincen.gov/statutes_regs/guidance/html/fin-2011-a003.html

Interagency Guidance on Privacy Laws and

Reporting Financial Abuse of Older Adults

https://www.sec.gov/news/press/2013/elder-abuse-guidance.pdf

Consumer Financial Protection Bureau

Recommendations and report for financial institutions on preventing

and responding to elder financial exploitation.

http://files.consumerfinance.gov/f/201603_cfpb_recommendatio

ns-and-report-for-financial-institutions-on-preventing-and-responding-to-elder-financial-exploitation.pdf

Consumer Financial Protection Bureau

Recommendations and report:

Fighting Elder Financial Exploitation through Community Networks

http://www.consumerfinance.gov/data-research/research-

reports/report-and-recommendations-fighting-elder-financial-exploitation-through-community-networks/

Mandated Reporting Requirements and Other Resources

Resources Website Address

2013 Nationwide Survey of Mandatory Reporting

Requirements for Elderly and/or Vulnerable Persons

http://www.napsa-now.org/wp-

content/uploads/2014/11/Mandatory-Reporting-Chart-Updated-FINAL.pdf

The United States Department of Justice on Elder Financial

Exploitation laws

https://www.justice.gov/elderjustice/prosecutors/statutes.html

National Adult Protective Services Association

http://www.napsa-now.org/get-informed/what-is-financial-

exploitation

U.S Department of Health and Human Services

http://www.aoa.gov

Answers on Aging - Financial Exploitation - Safeguarding Your Money and Property

http://www.n4a.org/

19

Glossary of Terms

Adult Protective Services (APS) - exists to receive and investigate incidents of abuse, neglect, or exploitation

of incapacitated or vulnerable adults, and to offer appropriate services in accordance with individual need

and acceptance.

At-Risk Adult – This is a term used to describe a protected individual that may be at risk based on age,

vulnerability to elder abuse based on mental incapacity.

Department of Health and Human Services - Department of Health and Human Services mission is to enhance

and protect the health and well-being of all Americans. We fulfill that mission by providing for effective health

and human services and fostering advances in medicine, public health, and social services.

Consumer Financial Protection Bureau (CFPB) - a U.S. government agency that makes sure banks, lenders, and

other financial companies treat consumers fairly...

Emerging Risk – New risks that are in the process of being understood and quantified by the industry and

regulatory community.

Financial Exploitation - when a person misuses or takes the assets of a vulnerable adult for his/her own

personal benefit. This frequently occurs without the exploit knowledge or consent of a senior or disabled adult,

depriving him/her of vital financial resources for his/her personal needs

Financial Abuse – Financial abuse is using the elder’s funds or assets different to the elder’s wishes, needs or

best interests – or for the abuser’s personal gain.

FinCEN - FinCEN's mission is to safeguard the financial system from illicit use and combat money laundering

and promote national security through the collection, analysis, and dissemination of financial intelligence and

strategic use of financial authorities.

The Gramm-Leach-Bliley Act - generally requires that a financial institution notify consumers and give them an

opportunity to opt out before providing nonpublic personal information to a third party. Today’s guidance

clarifies that it is generally acceptable under the law for financial institutions to report suspected elder financial

abuse to appropriate local, state or federal agencies.

Jamaican Lottery Scheme - Jamaican lottery schemes are not new and generally target retirement-age citizens

in the U.S. The scam has been modified in recent years to take advantage of the U.S. Department of the

Treasury's move to require benefit payments be made electronically. Benefit payments can be directed to an

account or to a prepaid debit card.

Mandated Reporters - A mandated reporter refers to “an individual required by law to report suspected or

confirmed abuse

Mentally Incapacitated – impairment by reason of mental illness, mental deficiency, mental disorder,

physical illness or disability, advanced age, chronic use of drugs, chronic intoxication or other cause to the

extent that a person lacks sufficient understanding or capacity to make or communicate informed decisions

concerning his/her person.

Money mule - sometimes referred to as a "smurfer" is a person who transfers money acquired illegally (e.g.,

stolen) in person, through a courier service, or electronically, on behalf of others. The mule is paid for their

services, typically a small part of the money transferred.

20

Neural Rules - Neural rules sometimes referred to as intelligence-based rules monitor for transactional patterns

based on the individuals normal transactional history

Protected Individual - Protected individuals are persons who by reason of their age or physical impairment

cannot manage their own affairs.

Reporting Protocol – the procedure that an organization has in place to report elder financial exploitation.

Static Rules - Static rules, sometimes referred to as peer group analysis are built on specific scenarios that

represent possible suspicious activity based on the peer group in question.

Suspicious Activity Reports - In financial regulation, a suspicious activity report (or SAR) is a report made by a

financial institution about suspicious or potentially suspicious activity.

Undue Influence – This term is often used to describe the when a person in a position of trust takes advantage

of a vulnerable adult to gain control of their money, property, or their life – either directly or through a POA, a

trust, marriage, adoption or inheritance.