casemark/bsa-risk-assessment
skills/legal/bsa-risk-assessment/SKILL.md
Drafts a BSA/AML Risk Assessment for U.S. financial institutions per FinCEN, FFIEC, and OCC standards. Evaluates inherent risks (customer, product, geographic, transaction, third-party), control adequacy, and residual risk. Use when preparing annual BSA compliance assessments, post-acquisition integration reviews, or when business changes trigger reassessment under 31 U.S.C. § 5318(h).
$ install --global
skillsauthnpx skillsauth add casemark/skills bsa-risk-assessmentInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 25, 2026, 3:30 AM27.1s1 file scanned
SKILL.md
- name:
- bsa-risk-assessment
- language:
- en
- description:
- Drafts a BSA/AML Risk Assessment for U.S. financial institutions per FinCEN, FFIEC, and OCC standards. Evaluates inherent risks (customer, product, geographic, transaction, third-party), control adequacy, and residual risk. Use when preparing annual BSA compliance assessments, post-acquisition integration reviews, or when business changes trigger reassessment under 31 U.S.C. § 5318(h).
BSA/AML Risk Assessment
Produces examination-ready BSA Risk Assessments evaluating inherent AML/CFT risks against mitigating controls per FFIEC BSA/AML Examination Manual methodology.
Prerequisites
Gather before drafting:
- Institution profile — entity type, charter/regulator, total assets, branch footprint, international relationships
- Products & services — inventory with volumes for high-risk products (wires, monetary instruments, prepaid, trade finance, crypto on/off ramps)
- Customer data — segments with counts of high-risk categories (cash-intensive businesses, PEPs, NRAs, MSBs, foreign correspondents)
- BSA/AML program docs — policies, CIP/CDD/EDD procedures, monitoring system specs, training records
- Filing history — annual CTR/SAR counts by category
- Independent testing — most recent scope, findings, remediation status
- Regulatory history — outstanding MRAs, MOUs, enforcement actions
Document Sections
1. Executive Summary
Overall risk rating (Low/Moderate/High), key concentrations, control gaps, priority recommendations with owners and target dates.
2. Introduction
- Regulatory basis: 31 U.S.C. § 5318(h); 31 C.F.R. § 1020.210
- Scope: all business lines, products, customers, geographies
- Assessment period and update frequency (typically annual)
- FFIEC risk-based methodology alignment
3. Institution Overview
Table covering: entity type, charter/regulator, total assets, branch count, high-risk products offered, customer segments, annual CTR/SAR filing counts.
4. Inherent Risk Identification
Five risk dimensions, each rated High/Moderate/Low:
- Customer — cash-intensive businesses, MSBs, NBFIs, PEPs, NRAs, nonprofits, foreign correspondents, FATF-listed jurisdiction customers
- Product & Service — flag products enabling anonymity, rapid movement, or cross-border activity (wires, prepaid, private banking, trade finance, digital channels, crypto)
- Geographic — HIDTA/HIFCA areas, FATF grey/black list jurisdictions, FinCEN GTO zones, OFAC sanctioned countries
- Transaction — high-volume cash, structuring patterns, funnel accounts, rapid cycling, shell companies, trade-based ML
- Third-Party — independent agents, outsourced onboarding/processing, fintech partnerships
5. Risk Assessment Matrix
Per risk category:
| Risk | Inherent | Likelihood | Impact | Mitigating Controls | Residual | |---|---|---|---|---|---| | [Category] | H/M/L | H/M/L | H/M/L | [Description] | H/M/L |
Reference FATF typology reports and FinCEN advisories for current typologies (ransomware, elder exploitation, human trafficking, real estate, virtual assets).
6. Controls & Mitigation
Evaluate each BSA program component against its regulatory basis:
| Component | Citation | |---|---| | CIP | 31 C.F.R. § 1020.220 | | CDD / Beneficial Ownership | 31 C.F.R. § 1010.230 | | EDD | FFIEC Manual | | Transaction Monitoring | FFIEC Manual | | OFAC Screening | 31 C.F.R. Part 501 | | CTR Filing | 31 U.S.C. § 5313 | | SAR Filing | 31 U.S.C. § 5318(g) | | BSA Officer / Governance | 31 C.F.R. § 1020.210 | | Training | 31 C.F.R. § 1020.210 | | Independent Testing | 31 C.F.R. § 1020.210 |
For each: document current status and adequacy rating.
7. Conclusions & Recommendations
- Overall risk determination with narrative justification
- Residual risks where controls are insufficient
- Prioritized remediation table (recommendation, priority, owner, target date)
Verification Requirements
These items change over time — confirm before finalizing:
- [ ] FATF grey/black list countries — verify at fatf-gafi.org
- [ ] Active FinCEN GTOs — jurisdiction-specific and time-limited
- [ ] Beneficial ownership threshold (currently 25%) — check for subsequent FinCEN rulemaking
- [ ] FinCEN advisory numbers — verify FIN numbers and dates before citing
Pitfalls
- Quantitative support required — risk ratings must cite transaction volumes, SAR counts, or alert rates; qualitative assertions alone are insufficient
- Board presentation — document must be board-approved or presented to senior management with evidence of review
- Version retention — keep prior assessments; regulators compare year-over-year
- Privilege risk — do not include attorney-client privileged material if document will be produced to examiners
- FFIEC citations — reference specific Examination Manual sections when evaluating control adequacy
Related Skills
casemark/medical-records-gap-analysis
tools
VerifiedTrustedCommunity
Audits the complete in-scope medical-record universe in a litigation matter and produces an attorney-facing, Bates-cited analysis of treatment gaps, missing records or providers, baseline coverage, material billing or production mismatches, and complaint evolution. Use when asked to find missing medical records, analyze treatment gaps or first-care timing, identify absent providers, assess whether a production is complete, or prepare a records-request target list. Use medical-record-chronology instead when the primary request is a chronological clinical narrative.
40SKILL.mdUpdated Sep 3, 2026
casemark/private-placement-memo
development
VerifiedTrustedCommunity
Drafts a legally compliant Private Placement Memorandum for Regulation D offerings (Rule 506(b)/506(c)), covering full disclosure framework including risk factors, capitalization, securities terms, use of proceeds, and investor qualification requirements. Enforces SEC anti-fraud compliance under Section 10(b)/Rule 10b-5, blue sky law considerations, and accredited investor verification under Rule 501. Use this skill when drafting PPMs, offering memorandums, Reg D disclosure documents, or private offering circulars for issuers raising capital from sophisticated investors. Also trigger when the user mentions private placement disclosure, offering memorandum, Reg D fundraising, or accredited investor verification. Even if the user just says "PPM" or "draft our offering memo," use this skill.
40SKILL.mdUpdated Apr 17, 2026
casemark/privacy-law-updates
data-ai
VerifiedTrustedCommunity
Generates structured privacy and data protection law briefings across US, EU, UK, and other jurisdictions. Organizes by jurisdiction with compliance deadlines, enforcement actions, and legislative changes. Use when preparing privacy law briefings, compliance updates, regulatory change summaries, or data protection landscape reviews.
40SKILL.mdUpdated Apr 17, 2026
casemark/prior-art-summary
testing
VerifiedTrustedCommunity
Generates structured summaries of prior art references for patent prosecution, validity analysis, and freedom-to-operate assessments. Maps disclosures to claim elements with precise citations. Use when summarizing prior art, analyzing patent landscapes, mapping references to claims, or preparing office action responses.
40SKILL.mdUpdated Apr 17, 2026