RISKS WITH SAME DAY ACH

Transcription

1 RISKS WITH SAME DAY ACH Kevin Olsen, AAP, NCP SVP of Payments Education About epayresources Not-for-profit Regional Payments Association Educational Programs & Payments Publications Member Benefits Voice & Representation in National Rule Making and Regulatory Process Payments Answerline Toll-Free Phone Support Discounts on Seminars, Publications, and Conferences 20 ACH Accredited Professionals (AAP) 4 National Check Payments Professionals (NCP) 3 Certified NCP Instructors 1 Certified Cash Manager Professional (CCM) 2 Certified Internal Auditor (CIA) 2 Certified Information Systems Auditors (CISA) 1 Certified Financial Services Auditor (CFSA) 2 1

2 Disclaimer This presentation and applicable materials are intended for general education purposes and nothing in this presentation should be considered to be legal, accounting or tax advice You should contact your own attorney, accountant or tax professional with any specific questions you might have related to this presentation that are of a legal, accounting or tax nature Image source: Thinkstock 3 Before We Begin random CApitALIZAtiOn Many of the words that are capitalized (Entry, Receiver, Check, etc ) can be found in Article Eight of the 2017 NACHA Operating Rules & Guidelines Article Eight provides a definition of each of the capitalized words 4 2

3 Agenda Going live! Schedules Impacted Strategy for Same Day ACH ODFI Risk Management RDFI Operational Risk Considerations Identification Please Credit Risk Rises Again 5 Going Live 6 3

4 Phased Approach to Same-Day ACH Functionality Phase 1 Sept. 23, 2016 Transaction Eligibility ($25,000 limit; IAT not eligible) Phase 2 Sept. 15, 2017 Phase 3 March 16, 2018 Credits only Credits and debits Credits and debits New Same Day ACH ODFI Processing Deadlines 10:30 AM ET and 2:45 PM ET 10:30 AM ET and 2:45 PM ET 10:30 AM ET and 2:45 PM ET New Settlement Time(s) 1:00 PM ET and 5:00 PM ET 1:00 PM ET and 5:00 PM ET 1:00 PM ET and 5:00 PM ET ACH Credit Funds Availability End of RDFI s processing day End of RDFI s processing day 5:00 PM RDFI local time 7 What Day of the Week is September 15, 2017? 8 4

5 ODFI Risk Management 9 Strategy for Same Day ACH Have an overall strategy for offering Same Day ACH Should Same Day be offered to all or select consumer and/or corporate customers? Not all Originators may be suitable for same-day origination Not all FI products may be suitable for same-day origination If so, determine how to flag or otherwise set up processes to ensure only those categories permitted to use Same Day ACH are using it 10 5

6 Who Gets It? Consider customer s profile (i.e., business model) when offering Same-Day ACH Current credit limits Prefunding and exposure Authentication methods Review Files, or have processes in place to determine compliance, with same day eligibility rules 11 RDFI Operational Risk Considerations 12 6

7 Funds Availability If posting practices are not correctly implemented, untimely credit of non-consumer credits could result in consequential damages under UCC4A Consumer credits and debits according to NACHA Operating Rules 13 Phased Approach to Same-Day ACH Functionality Phase 1 Sept. 23, 2016 Transaction Eligibility ($25,000 limit; IAT not eligible) Phase 2 Sept. 15, 2017 Phase 3 March 16, 2018 Credits only Credits and debits Credits and debits New Same Day ACH ODFI Processing Deadlines 10:30 AM ET and 2:45 PM ET 10:30 AM ET and 2:45 PM ET 10:30 AM ET and 2:45 PM ET New Settlement Time(s) 1:00 PM ET and 5:00 PM ET 1:00 PM ET and 5:00 PM ET 1:00 PM ET and 5:00 PM ET ACH Credit Funds Availability End of RDFI s processing day End of RDFI s processing day 5:00 PM RDFI local time 14 7

8 End of Day Processing If you described your End of Day Processing as being complete before 4 p.m. ET you will need to make a business decision on if you will change that now for Phase 1 For a credit Same Day Entry, an RDFI must make the amount of the credit Entry available in the Receiver s account no later than the completion of the RDFI s processing for that Settlement Date, subject to its right to return the Entry under these Rules 15 End of Day Processing With the 4 p.m. ET set for the target distribution of the new second window your ultimate goal is to be able to provide funds by 5 p.m., RDFI local time in Phase

9 5:00 PM RDFI Local Time Rule does not specify a required method of calculating local time in order to allow RDFIs flexibility in using a consistent standard that is most easily applied in an RDFI s specific processing environment For many RDFIs, the determination of local time is straightforward; for example, cases in which the RDFI s geographic footprint is limited to a single time zone In other cases, an RDFI can determine local time based on the branches in which specific accounts were opened An RDFI also could utilize a customer s address in determining local time for that customer s account 17 Posting Order Posting timing & order Reputational risk for variable EOD times? Posting order Timing of returns vs. same day credits Expectations of consumers 18 9

10 Identification Please 19 Identification of Same-Day ACH Entries Same Day ACH transactions will be identified and processed by the ACH Operator using the date provided in the Effective Entry Date field Same Day ACH transactions will be identified by the ODFI and its Originator by using the current day s date in the Effective Entry Date field of the batch of ACH transactions 20 10

11 Handling of Stale/Invalid Effective Entry Dates A C H Today s date: Oct. 25, 2016 Batch EED: Batch submitted by 10:30 AM ET Batch submitted by 2:45 PM ET Batch submitted after 2:45 PM ET Batch settled 10/25/16, 1:00 PM ET Same Day Entry Fee charged Batch settled 10/25/16, 5:00 PM ET Same Day Entry Fee charged Batch settled 10/26/16, 8:30 AM ET No Same Day Entry Fee charged 21 Cash Flow Issues for Originators Without a Same-Day ACH indicator, stale-dated transactions could settle sooner than intended causing cash flow implications for the Originator Effective Entry Date Company Descriptive Date (optional) Company Discretionary Data (optional) 22 11

12 Debits Early to Receiver Accounts Errors in dating and detecting Same-Day ACH resulting in Receivers unintentionally being debited earlier than expected Could result in unauthorized returns 23 Error ODFI, TPSP or Operator with processing errors (duplicate or erroneous file/batch) will be settled more quickly, which means less time for the party causing the error to correct the situation 24 12

13 Reversals A reversing Debit for an erroneous Same-Day Credit may still be returned 25 Reversals for Debits A reversing Credit for an erroneous Debit does not stop the Debit from being returned unauthorized RDFI credits receivers account and returns SDA Debits as unauthorized Possible RDFI post reversing Credit 26 13

14 Settlement Position Next day settlement provides RDFIs visibility into their Fed settlement position the following day This practice will not exist with SDA transactions 27 End-of-Day Overdraft RDFI (Phase Two and onward) Financial institutions may receive a high volume of debit transactions, which could result in a daylight or end-of-day overdraft (new risk) 28 14

15 Stop Payments Same-Day ACH will limit the ability of RDFIs to place stop payments on items Instead of having Stop Payments the RDFI is forced to return them as unauthorized, which result in greater RDFI and Receiver costs and time 29 Fines for Exceeding $25,000 limit ACH Rules Enforcement Panel will have final authority on any instances when it appears that an ODFI, Originator or Third-Party Sender is attempting to evade the limit Will you be able to detect if an originator is attempting to avoid the $25,000 limit? What happens if an item above the $25,000 is submitted in a same day file? Items above $25,000 will be held for next day processing 30 15

16 Credit Risk Rises Again 31 Prefunding/Credit Risk Phase 1 credits only Collect debit before releasing credits 32 16

17 I Feel the Need for Speed 33 Corporate Services Positive pay Reverse positive pay Debit blocks Debit filters 34 17

18 Faster Processing Last years EMV release coupled with the faster processing in ACH is almost as if we are issuing a challenge to fraudsters EMV = deterrence Faster ACH processing = increased chances of fraud 35 More Files Two new same day settlement windows, enabling financial institutions to go from once-aday processing of file to three times a day 36 18

19 Targeting other Payment Channels Fraudsters will know that financial institutions will be placing more emphasis and resources on ACH deadlines 37 Timing Submit large volume of payments just before the cut-off time, forcing financial institutions to rush through the review process Could result in some payments getting through undetected ODFIs need to establish cutoff times for Originators giving a comfortable time frame to process, handle any issues, and get the file to the Operator by their deadline 38 19

20 If it Ain t Broke Don t Fix it (Same Old Risk) 39 Social Engineering Techniques Not NEW! BUT there is less time to uncover the underlying scam! 40 20

21 Altered Files Addition of recipients to files (payroll) or the change of account information for existing recipients within a file Extremely hard enough to detect today and will be even harder to detect when we accelerate the moving of payments 41 Account Takeover With the high volume of payments that may need to be reviewed in two very short windows of time, nefarious third-parties or originators may take advantage of these processing windows Requires improved AML and BSA monitoring (compliance risk) 42 21

22 Third-Party Sender Risk Factors Number of Originators Mix of Debits and Credits Return Rates 43 Possible Solutions 44 22

23 Don t Wait, Prepare Now Same-Day ACH is being implemented in three phases Phase 1 September 23, 2016 Phase 2 September 15, 2017 Phase 3 March 16, 2018 Don t wait to start preparing and testing 45 Transaction Review Transaction review procedures More transaction to review in less time Hire and train more staff Use software Existing software New software Advanced authentication Behavioral biometrics 46 23

24 RDFI Suspects Credit is Unauthorized An RDFI that suspects a credit is unauthorized may treat a same day credit the same as other credit Entries, by researching and notifying the ODFI of any delays Enables the ODFI to verify with the Originator Voluntary Exception Rule 47 Fraud Prevention Controls Faster payments is awesome, for Originators, Receivers, and fraudsters Shorter time between fraud action and access to funds, could equal less probability of getting caught FIs should expect more fraud attempts and new criminal tactics Financial institutions need to increase their security by putting in place new processes and solutions to address existing and new threats What your doing now, will it work when we are moving payments faster? 48 24

25 Increase/Improve Fraud Reviews As the network moves to more processing and settlement windows FIs need to improve their review process Additional solutions Training Hire additional staff Software Accept increased risk, and review a smaller portion of the transactions 49 Additional Staff Qualifications (AAP) Training Cost 50 25

26 Software Purpose Monitoring Real time alerts Reporting Detection Cost Training 51 Policies & Procedures Update policies and procedures related to returns and NOCs should be reviewed to allow for: Returns and NOCs have more available windows for transmission Allows these Entries to be sent from the RDFI to the ODFI more quickly Reduced credit risk when Entries are returned sooner, but RDFIs are not required to send returns faster 52 26

27 Incident Response An incident response plan should include actions for stopping account takeover and should be reviewed at least annually Updated for Same-Day ACH 53 Dedicated PC s Use dedicated PC with the most current data security software, robust firewalls, for accessing online banking and initiating payments 54 27

28 Resources NACHA Same Day ACH page: NACHA provides an Emergency FI Contact Database as a resource for communication information during a crisis: financial institutions can collaborate and share information as needed to mitigate threats impact on dayto-day operations This database is designed to include contact information for your financial institution s key personnel responsible for coordinating threat response activity Go to Register and populate your financial institution s specific contact information View other financial institutions information 55 Continuing Education Credits AAP Continuing Education Credits Session title: Risk in the Same-Day ACH Environment Session is worth 1.2 AAP CE (continuing education) credits Topic area: Risk Management Date conducted: 2/9/17 Conducted by: epayresources Some of our sessions may also be eligible for other industry certification renewal credits Check with your certifying organization for eligibility requirements 56 28

29 57 Kevin Olsen, AAP NCP SVP Payments Education ext

30 General Information Education Dept. 59 epayadvisors provides payments-related risk management, compliance, and consulting services to financial institutions and businesses throughout the U.S. Our services include: Expanded Scope ACH Audit for financial institutions ACH Audit for Third-Party Senders & Third-Party Service Providers ACH Risk Assessment Remote Deposit Capture Audit Remote Deposit Capture Risk Assessment Wire Transfer Audit Wire Transfer Risk Assessment Payments Consulting For a free quote visit us at:

31 Connect with Follow epayresources Like epayresources Download Our Education Catalog 62 31