the earliest time practicable after banking hours;

(6) Provide, where practicable, for designation of a person or persons to open each banking office and require him or them to inspect the premises, to ascertain that no unauthorized persons are present, and to signal other employees that the premises are safe before permitting them to enter;

(7) Provide for designation of a person or persons who will assure that all security devices are turned on and are operating during the periods in which such devices are intended to be used;

(8) Provide for designation of a person or persons to inspect, after the closing hour, all areas of each banking office where currency, negotiable securities, or similar valuables are normally handled or stored in order to assure that such currency, securities, and valuables have been put away, that no unauthorized persons are present in such areas, and that the vault or safe and all doors and windows are securely locked; and

(9) Provide for training, and periodic retraining, of employees in their responsibilities under the security program, including the proper use of security devices and proper employee conduct during and after a robbery, in accordance with the procedures listed in Appendix B of this part.

[34 FR 618, Jan. 16, 1969, as amended at 53 FR 17917, May 19, 1988]

§ 326.5 Reports and records.

(a) Compliance reports. As of the last business day in June of each year, each insured nonmember bank shall complete a compliance report certifying to its compliance with the security requirements of this subpart. This report shall be signed by the president or cashier or managing officer of the bank or the managing official of an insured branch of a foreign bank and shall be retained in the bank files for a period of three years for review by Federal Deposit Insurance Corporation examiners. The report may be in a form substantially as follows:

I hereby certify, to the best of my knowledge and belief, that this bank has developed and administers a security program that equals or exceeds

the standards prescribed by § 326.4 of the rules and regulations of the Federal Deposit Insurance Corporation: that such security program has been reduced to writing, approved by the bank's board of directors, and retained by the bank in such form as will readily permit determination of its adequacy and effectiveness; and that the bank security officer, after seeking the advice of law enforcement officers, has provided for the installation, mainte nance, and operation of appropriate security devices, as prescribed by § 326.3 of the rules and regulations of the Federal Deposit Insurance Corporation, in each of the bank's banking offices.

(b) [Reserved]

(c) Records of external crime. After a robbery, burglary, or nonemployee larceny is committed or attempted at a banking office of an insured nonmember bank, the bank shall keep & record of the incident at its main office, or in the case of an insured State branch of a foreign bank, at the banking office involved. The record may be a copy of a police, insurance or similar report of the incident. Altern tively, the bank may wish to develop its own record indicating the office at which the incident occurred, the type of crime, when the crime occurred and the amount of any loss; whether operational or mechanical deficiencies might have contributed to the crime; and what has been or will be done to correct any deficiencies.

(d) Special reports. Each insured nonmember bank shall file such other reports as the Board of Directors or its designee may require.

(Approved by the Office of Management and Budget under control number 30640095)

[34 FR 618, Jan. 16, 1969, as amended at 36 FR 1248, Jan. 27, 1971; 42 FR 10312, Feb. 22. 1977; 46 FR 15865, Mar. 10, 1981; 46 FR 49105, Oct. 6, 1981; 53 FR 17917, May 19, 1988]

§ 326.6 Corrective action.

Whenever the Board of Directors or its designee determines that the secu rity devices or procedures used by an insured nonmember bank are deficient in meeting the requirements of this part, or that the requirements of this

part should be varied in the circumstances of a particular banking office, it may take or require the bank to take necessary corrective action. If the Board of Directors or its designee determines that such corrective action is appropriate or necessary, the bank will be so notified and will be furnished a statement of what the bank must do to comply with the requirements of this subpart.

[34 FR 618, Jan. 16, 1969, as amended at 53 FR 17917, May 19, 1988]

§ 326.7 Penalty provision.

Pursuant to section 5 of the Bank Protection Act of 1968 (82 Stat. 295), and insured nonmember bank that violates any provision of this part shall be subject to a civil penalty not to exceed $100 for each day of the violation.

[34 FR 618, Jan. 16, 1969, as amended at 53 FR 17917, May 19, 1988]

Subpart B-Procedures for Monitoring

Bank Secrecy Act Compliance

§ 326.8 Bank Secrecy Act compliance.

(a) Purpose. This subpart is issued to assure that all insured nonmember banks 3 establish and maintain procedures reasonably designed to assure and monitor their compliance with the requirements of subchapter II of chapter 53 of title 31, United States Code, and the implementing regulations promulgated thereunder by the Department of Treasury at 31 CFR Part 103.

(b) Compliance procedures. On or before April 27, 1987, each bank shall develop and provide for the continued administration of a program reasonably designed to assure and monitor compliance with recordkeeping and reporting requirements set forth in subchapter II of chapter 53 of title 31, United States Code, and the implementing regulations promulgated thereunder by the Department of Treasury at 31 CFR Part 103. The

3 In regard to foreign banks, the programs and procedures required by Section 326.8 need be instituted only at an "insured branch" as defined in 12 CFR 346.1(g) which is a "State branch" as defined in 12 CFR 346.1(f).

compliance program shall be reduced to writing, approved by the board of directors and noted in the minutes.

(c) Contents of compliance program. The compliance program shall, at a minimum:

(1) Provide for a system of internal controls to assure ongoing compliance; (2) Provide for independent testing for compliance to be conducted by bank personnel or by an outside party;

(3) Designate an individual or individuals responsible for coordinating and monitoring day-to-day compliance; and

(4) Provide training for appropriate personnel.

(Approved by the Office of Management and Budget under control number 30640087)

[52 FR 2860, Jan. 27, 1987, as amended at 53 FR 17917, May 19, 1988]

APPENDIX A-MINIMUM STANDARDS FOR SECURITY DEVICES

In order to assure realization of maximum performance capabilities, all security devices utilized by a bank should be regularly inspected, tested, and serviced by competent persons. Actuating devices for surveillance systems and robbery alarms should be operable with the least risk of detection by unauthorized persons that can be practicably achieved.

(1) Surveillance systems—(i) General. Surveillance systems should be:

(A) Equipped with one or more photographic, recording, monitoring, or like devices capable of reproducing images of persons in the banking office with sufficient clarity to facilitate (through photographs capable of being enlarged to produce a oneinch vertical head-size of persons whose images have been reproduced) the identification and apprehension of robbers or other suspicious persons;

(B) Reasonably silent in operation; and

(C) So designed and constructed that necessary services, repairs or inspections can readily be made. Any camera used in such a system should be capable of taking at least one picture every 2 seconds and, if it uses film, should contain enough unexposed film at all times to be capable of operating for not less than 3 minutes, and the film should be at least 16mm.

(ii) Installation and operation of surveil lance systems providing surveillance of other than walk-up or drive-in teller's stations or windows. Surveillance devices for

other than walk-up or drive-in teller's stations or windows should be:

(A) Located so as to reproduce indentifiable images of persons either leaving the banking office or in a position to transact business at each such station or window; and

(B) Capable of actuation by initiating devices located at each teller's station or window.

(iii) Installation and operation of surveil lance systems providing surveillance of walk-up or drive-in teller's stations or windows. Surveillance devices for walk-up or drive-in teller's stations or windows should be located in such a manner as to reproduce identifiable images of persons in a position to transact business at each such station or window and areas of such station or window that are vulnerable to robbery or larceny. Such devices should be capable of actuation by one or more initiating devices located within or in close proximity to such station or window. Such devices may be omitted in the case of a walk-up or drive-in teller's station or window in which the teller is effectively protected by a bullet-resistant barrier from persons outside the station or window. However, if the teller is vulnerable to larceny or robbery by members of the public who enter the banking office, the teller should have access to a device to actuate a surveillance system that covers the area of vulnerability or the exits to the banking office.

(2) Robbery and burglary alarm systems(i) Robbery alarm systems. A robbery alarm system should be provided for each banking office at which the police ordinarily can arrive within 5 minutes after an alarm is actuated; all other banking offices should be provided with appropriate devices for promptly notifying the police that a robbery has occurred or is in progress. Robbery alarm systems should be:

(A) Designed to transmit to the police, either directly or through an intermediary, a signal (not detectable by unauthorized persons) indicating that a crime against the banking office has occurred or is in progress;

(B) Capable of actuation by initiating devices located at each teller's station or window (except walk-up or drive-in teller's stations or windows in which the teller is effectively protected by a bullet-resistant barrier and effectively isolated from persons, other than fellow employees, inside a banking office of which such station or window may be a part);

(C) Safeguarded against accidental transmission of an alarm;

(D) Equipped with a visual and audible signal capable of indicating improper functioning of or tampering with the system; and

(E) Equipped with an independent source of power (such as a battery) sufficient to

assure continuously reliable operation of the system for at least 24 hours in the event of failure of the usual source of power.

(ii) Burglary alarm systems. A burglary alarm system should be provided for each banking office. Burglary alarm systems should be:

(A) Capable of detecting promptly an attack on the outer door, walls, floor, or ceiling of each vault, and each safe not stored in a vault, in which currency, negotiable securities, or similar valuables are stored when the office is closed, and any at tempt to move any such safe;

(B) Designed to transmit to the police. either directly or through an intermediary, a signal indicating that any such attempt is in progress; and for banking offices at which the police ordinarily cannot arrive within 5 minutes after an alarm is actuated, designed to actuate a loud sounding bell or other I device that is audible inside the banking office and for a distance of approximately 500 feet outside the banking office;

(C) Safeguarded against accidental transmission of an alarm;

(D) Equipped with a visual and audible signal capable of indicating improper functioning of or tampering with the system; and

(E) Equipped with an independent source of power (such as a battery) sufficient to assure continuously reliable operation the system for at least 80 hours in the event of failure of the usual source of power.

(3) Walk-up and drive-in teller's stations or windows. Walk-up and drive-in teller's stations or windows contracted for after February 15, 1969, should be constructed in such a manner that tellers are effectively protected by bullet-resistant barriers from robbery or larceny by persons outside such stations or windows. Such barriers should be of glass at least 16 inches in thickness, 1 or of material of at least equivalent bullet-resistance. Pass-through devices should be so designed and constructed as not to afford a person outside the station or window a direct line of fire at a person inside the sta tion.

(4) Vaults, safes, safe deposit boxes, night depositories, and automated paying or receiving machines. Vaults, safes (if not to be stored in a vault), safe deposit boxes, night depositories, and automated paying or receiving machines, in any of which currency, negotiable securities, or similar valuables are to be stored when banking offices are closed, should meet or exceed the standards expressed in this section.

'It should be emphasized that this thickness is merely bullet-resistant and not bulletproof.

3

(i) Vaults. A vault is defined as a room or compartment that is designed for the storage and safekeeping of valuables and which has a size and shape which permits entrance and movement within by one or more persons. Other asset storage units which do not meet this definition of a vault will be considered as safes. Vaults contracted for after November 1, 1973, 2 should have walls, floor, and ceiling of reinforced concrete at least 12 inches in thickness. 3 The vault door should be made of steel at least 31⁄2 inches in thickness, or other drill and torch resistant material, and be equipped with a dial combination lock, a time lock, and a substantial lockable day-gate. Electrical conduits into the vault should not exceed 11⁄2 inches in diameter and should be offset within the walls, floor, or ceiling at least once so as not to form a direct path of entry. A vault ventilator, if provided, should be designed with consideration of safety to life without significant reduction of the strength of the vault wall to burglary attack. Alternatively, vaults should be so designed and constructed as to afford at least equivalent burglary resistance. 1

"Vaults contracted for previous to this date should be constructed in conformance with all applicable specifications then in effect.

"The reinforced concrete should have: two grids of 5 (%" diameter) deformed steel bars located in horizontal and vertical rows in each direction to form grids not more than 4 inches on center; or two grids of expanded steel bank vault mesh placed parallel to the face of the walls, weighing at least 6 pounds per square foot to each grid, having a diamond pattern not more than 3" x 8"; or two grids of any other fabricated steel placed parallel to the face of the walls, weighing at least 6 pounds per square foot to each grid and having an open area not exceeding 4 inches on center. Grids are to be located not less than 6 inches apart and staggered in each direction. The concrete should develop an ultimate compression strength of at least 3,000 pounds per square inch.

'Equivalent burglary-resistant materials for vaults do not include the use of a steel lining, either inside or outside a vault wall, in lieu of the specified reinforcement and thickness of concrete. Nonetheless, there may be instances, particularly where the construction of a vault of the specified reinforcement and thickness of concrete would require substantial structural modification of an existing building, where compliance with the specified standards would be unreasonable in cost. In those instances, the bank should comply with the procedure set forth in § 326.3(c) of Part 326.

(ii) Safes. Safes contracted for after February 15, 1969, should weigh at least 750 pounds empty, or be securely anchored to the premises where located. The body should consist of steel, at least 1 inch in thickness, either cast or fabricated, with an ultimate tensile strength of 50,000 pounds per square inch and be fastened in a manner equal to a continuous 4 inch penetration weld having an ultimate tensile strength of 50,000 pounds per square inch. The door should be made of steel that is at least 11⁄2 inch in thickness, and at least equivalent in strength to that specified for the body; and the door should be equipped with a combination lock, or time lock, and with a relocking device that will effectively lock the door if the combination lock or time lock is punched. One hole not exceeding 1⁄2 inch diameter may be provided in the body to permit insertion of electrical conductors, but should be located so as not to permit a direct view of the door or locking mechanism. Alternatively, safes should be constructed of materials that will afford at least equivalent burglary resistance.

(iii) Safe deposit boxes. Safe deposit boxes used to safeguard customer valuables should be enclosed in a vault or safe meeting at least the above-specified minimum protection standards.

(iv) Night depositories. Night depositories (excluding envelope drops not used to receive substantial amounts of currency) contracted for after February 15, 1969, should consist of a receptacle chest having cast or welded steel walls, top, and bottom, at least 1 inch in thickness; a steel door at least 11⁄2 inches in thickness, with a combination lock; and a chute, made of steel that is at least 1 inch in thickness, securely bolted or welded to the receptacle and to a depository entrance of strength similar to the chute. Alternatively, night depositories should be so designed and constructed as to afford at least equivalent burglary resistance. Each depository entrance (other than an envelope drop slot) should be equipped with a lock. Night depositories should be equipped with a burglar alarm and be designed to protect against the "fishing" of a deposit from the deposit receptacle, and to protect against the "trapping" of a deposit for extraction.

(v) Automated paying or receiving machines. Except as hereinafter provided, cash dispensing machines (automated paying machines), including those machines which also accept deposits (automated receiving machines) contracted for after November 1,

"Equivalent burglary-resistant materials for night depositories include the use of inch steel plate encased in 6 inches or more of concrete or masonry building wall.

1973, should weigh at least 750 pounds empty, or be securely anchored to the premises where located. Cash dispensing machines should contain, among other features, a storage chest having cast or welded steel walls, top, and bottom, at least one inch in thickness, with a tensile strength of at least 50,000 pounds per square inch. Any doors should be constructed of steel at least equivalent in strength to the storage chest and be equipped with a combination lock and with a relocking device that will effectively lock the door if the combination lock is punched. The housing covering the cash dispensing opening in the storage chest and the housing covering the mechanism for removing the cash from the storage chest, should be so designed as to provide burglary resistance at least equivalent to the storage chest and should also be designed to protect against the "fishing" of cash from the storage chest. The cash dispensing control and delivering mechanism (and, when applicable, cash deposit receipt mechanism) should be protected by steel, at least 1⁄2 inch in thickness, securely attached to the storage chest. A cash dispensing machine which also receives deposits should have a receptacle chest having the same burglary resistant characteristics as that of cash dispensing storage chest and should be designed to protect against the fishing and trapping of deposits. Necessary ventilation for the automated machines should be designed so as to avoid significantly reducing the burglary resistance of the machines. The cash dispensing machine should also be designed so as to be protected against actuation by unauthorized persons, should be protected by a burglar alarm, and should be located in a welllighted area. Alternatively, cash dispensing machines should be so designed and constructed as to afford at least equivalent burglary resistance. " A cash dispensing machine which is used inside a bank's premises only during bank business hours, and which is empty of currency and coin at all other times, should at least provide safeguards against "jimmying," unauthorized opening of the storage chest door, and against actuation by unauthorized persons. [38 FR 27832, Oct. 9, 1973]

"Equivalent burglary-resistant materials for cash dispensing machines include the use of % inch thick nickel stainless steel meeting American Society of Testing Materials (ASTM) Designation A 167-70, Type 304, in place of 1 inch thick steel, if other criteria are satisfied.

APPENDIX B-PROPER EMPLOYEE CONDUCT DURING AND AFTER A ROBBERY

With respect to proper employee conduct during and after a robbery, employees should be instructed:

(1) To avoid actions that might increase danger to themselves or others;

(2) To activate the robbery alarm system and the surveillance system during the robbery, if it appears that such activation can be accomplished safely;

(3) To observe the robber's physical features, voice, accent, mannerisms, dress, the kind of weapon he has, and any other characteristics that would be useful for identifi cation purposes;

(4) That if the robber leaves evidence (such as a note) to try to put it aside and out of sight, if it appears that this can be done safely; retain the evidence, do not handle it unnecessarily, and give it to the police when they arrive; and refrain from touching, and assist in preventing others from touching, articles or places the robber may have touched or evidence he may have left, in order that fingerprints of the robber may be obtained;

(5) To give the robber no more money than the amount he demands and include "bait" money in the amount given;

(6) That if it can be done safely, to observe the direction of the robber's escape and the description and license plate number of the vehicle used, if any;

(7) To telephone the local police, if they have not arrived, and the nearest office of the Federal Bureau of Investigation, or inform a designated officer or other employee who has this responsibility that a robbery has been committed;

(8) That if the robber leaves before the police arrive, to assure that a designated officer or other employee waits outside the office, if it is safe to do so, to inform the police when they arrive that the robber has left;

(9) To attempt to determine the names and addresses of other persons who witnessed the robbery or the escape and request them to record their observations or to assist a designated officer or other employee in recording their observations; and

(10) To refrain from discussing the details of the robbery with others before recording the observations respecting the robber's physical features and other characteristics as hereinabove described and the direction of escape and description of vehicle used, if any.

Sec.

PART 327-ASSESSMENTS

327.01 Purpose and scope.

327.02 Reporting of assessment base additions for unposted credits and deductions for unposted debits.