WorldLink Payment Services Management Guide

Transcription

1 WorldLink Payment Services Management Guide

2 Preface WorldLink Payment Services ( WorldLink ) is a multi-currency cross-border payment service offered through Citibank Europe plc, an Ireland-based financial services company with its principal office located in Dublin, Ireland ( Citibank Europe ). Payments through WorldLink are made through Citibank Europe and various of its affiliates ( Affiliates and, together with Citibank Europe as the case may be, Citibank ). This WorldLink Payment Services Management Guide (this Management Guide ) forms a part of, and is incorporated by reference in, your organization s WorldLink services contract except as may be expressly otherwise agreed. Citibank Europe may, at its discretion, reasonably modify or amend this Management Guide from time to time, which modification or amendment will become binding when your organization receives access to a copy of it. If Citibank Europe or any Affiliate provides software to you, your rights and responsibilities, and those of Citibank Europe, regarding the performance of the software and the proprietary communications network utilized by the software, or any problems with such performance, shall be governed exclusively by a software license agreement or other agreement containing such software license that your organization has entered into with Citibank. By this Management Guide, neither Citibank Europe nor any of it s Affiliates takes on any responsibility with respect to such performance or problems except as otherwise provided in such software license agreement. Your organization must hold strictly confidential all non-public information, whether oral or written, obtained now or later by your organization from Citibank Europe or its Affiliates. This information includes, without limitation, information regarding pricing, operational, credit, marketing and general business practices, as well as information contained in this Management Guide or in any agreements relating to this Management Guide. Your organization shall not disclose such information to any third party without Citibank Europe s prior written consent, unless specifically required by court order, court procedure, law or regulation. Unless otherwise expressly agreed, Citibank Europe shall hold strictly confidential all non-public information regarding your organization, whether oral or written, obtained now or later by it from your organization in the course of performing its obligations under this Management Guide and under any related agreements or arrangements and shall not disclose such information to any third party without your organization s written consent, except as follows: (i) Disclosures required by court order, court procedure, law, regulation, or any governmental department or agency without regard to its authority. (ii) Disclosures to Citibank Europe or any of its Affiliates, subsidiaries, branches, correspondents, auditors, consultants, accountants or attorneys; provided, such parties agree to hold such disclosed information on a strictly confidential basis. (iii) Disclosures to a third party respecting an individual check (e.g., On-Site or Remote) or other transfer (e.g., Funds Transfer, or Cross Border ACH payment or other method), when that third party already knows the serial number or other identifying number of such check or transfer. The authoritative and official text of this Management Guide shall be in the English language as used in the United States of America. Any translation from the English text of this Management Guide is for the convenience of the parties and any inconsistencies or inaccuracies between the English text and any translation shall be resolved in favor of the English text. The rights and obligations of your organization and Citibank Europe or any of its Affiliates, subsidiaries or correspondents, including their respective successors and assigns, are subject to and limited by all applicable local laws and regulations, including, without limitation, any foreign currency exchange control laws and regulations. Because such laws and regulations are subject to change without notice, Citibank Europe or any of its Affiliates, subsidiaries, branches or correspondents do not make any representations with respect to such laws and regulations. It is your organization s responsibility to ascertain and comply with such laws and regulations. You may not use WorldLink for any illegal activities, including, but not limited to, the payment of any gambling debt or proceeds.

3 Contents Contents... 1 Purpose... 1 Contents... 1 Terminology... 1 Using This Guide... 1 Audience Additional Documentation Overview... 3 Governing Law... 3 Local Taxes on Funds Transfers... 3 Payment Types... 4 Communication Methods... 4 CitiDirect Online Banking... 4 File Transmission... 4 SWIFT... 4 Processing Summary... 5 Payment Initiation... 5 Transaction Funding... 6 Reconcilement... 6 Customer Assistance... 6 United States Regulations Related to WorldLink Payment Services... 7 U.S. Trade Sanctions and Embargoes... 7 U.S. Travel Rule... 7 Scope of the Travel Rule... 7 Travel Rule Exceptions/Exemptions Security... 9 Preview... 9 Citibank Europe Security Procedures... 9 Client Number... 9 Transaction Reference Number... 9 WorldLink Check Security... 9 WorldLink Cash Security...10 Currency Purchase Contract Rate Confirmation...10 Message Transmission Security...10 File Transmission...10 WorldLink via CitiDirect Online Banking...11 SWIFT...11 Additional CitiDirect Online Banking Security Features...11 Access Controls...11 User Profiles and Entitlements...11 IDs and Passwords...12 Software Time Outs...12 Audit Trails...12 Payment Security...12 Your Security Provisions Payment Types...13 Preview...13 WorldLink Funds Transfers...13 Sending Funds Transfers Charges Prompt Reporting of Fraudulently Requested Transfers WorldLink Remote Checks Remote Check Crossing Effect of Check Crossing on Your Remote Check Issuance Remote Check Personalization Check Printing and Delivery Prompt Reporting of Fraudulently Requested Remote Checks WorldLink On-Site Checks Check Stock Receiving Check Stock Guidelines for Administering Check Stock.. 17 Checks Made Out to Bearer Mailing an On -Site Check On-Site Check Crossing Effect of Check Crossing Your On -Site Check Voiding On-Site Checks Resolving Paid Unadvised (PUA) Items Prompt Reporting of Lost, Stolen, or Fraudulently Issued Checks Check Fraud Responsibility Cross Border ACH Payments WorldLink Cash Cash Charges Prompt Reporting of Fraudulently Requested Transfers Manually Initiated Funds Transfer WorldLink Payment Services Options Transaction Funding Previ ew Funding Currencies Foreign Currency Exchange Rate Quotation Formats All Divide All Multiply Interbank Rate Quotation Types Spot Rates Calling a WorldLink Foreign Currency Representative Using the Online Rates Facility WorldLink Payment Services Automatically Apply Rates Daily Rates Forward Rates Available Currencies Figure One: Currencies Commonly Traded in the Forwards Market Forwards Process... 27

4 Foreign Currency Exchange Confirmation Letter...27 Funding Amount...28 Funding Methods...28 Automatic Debit (Autofunding)...28 Funding Accounts for Automatic Debit...28 Manual Remittance...28 Remit Due Date Reconcilement...30 Preview...30 Information for Reconcilement...30 Types of Reconcilement...30 Reconcilement Information...30 File Transmission Additional Information..31 WorldLink Payment Services via SWIFT Additional Information...31 Financial Difference Statement...31 Summary of Outstanding Financial Differences...31 Detailed Explanation and Suggested Corrective Action...31 Name and Telephone Number for Assistance 31 6 Service Requests...33 Preview...33 Customer Service Notes...33 Call Back Procedures...33 Have Reference Numbers Available...33 Contingency Means of Communication Card and Standing Order for Refunds...33 Refunds...34 Status Requests...34 Requesting the Status of On-Site Checks...35 Using the Citibank Voice Response Status System...35 Requesting Status from a Citibank Representative...35 Status Information Provided for Checks...35 Requesting the Status of Remote Checks...36 Using the Citibank Voic e Response Status System...36 Requesting Status from a Citibank Representative...36 Status Information Provided for Remote Checks...36 Requesting the Status of Funds Transfer Cross Border ACH and Cash...37 Requesting Status from a Citibank Representative...37 Check Stop Payment Requests...37 Requesting a Stop Payment...38 Requesting a Stop Payment...38 Providing Information to WorldLink Payment Services...38 Stop Payment Reference Number...38 Canceling a Stop Payment...38 Check Photocopy Requests Requesting a Photocopy from a Citibank Representative WorldLink Check Fraud Procedures Overview Forgeries Forgery Types: Counterfeit Checks Alteration Forged/Unauthorized Endorsement Paid After Death Fraud Detection and Return Process Check Recovery Process WorldLink Cash Fraud Procedures Returned Funds Transfer Payments Returned Cash Payments Funds Transfer and Cross Border ACH Recall Requests Cash Recalls Requesting a Recall Providing Information to WorldLink Payment Services Response to Your Recall Request Successful Recall Process Unsuccessful Recall Process Glossary Abbreviations and Acronyms Terms Same Day/Next Day Currencies... 53

5 Contents Purpose This Management Guide provides important operational and administrative information for users of WorldLink Payment Services On-Site Checks, Remote Checks, Funds Transfers, Cross Border ACH, Cash and other types of payments that are made available to your organization through WorldLink. You are expected to familiarize yourself thoroughly with the contents of this Management Guide. Contents This Management Guide contains the following chapters: Chapter 1 Overview introduces WorldLink, summarizes the communication methods that can be used to send payment instructions and information to WorldLink, and describes payment processing. Chapter 2 Security discusses security aspects of issuing payment instructions via WorldLink Payment Services. Chapter 3 Payment Types explains the types of disbursements available with WorldLink Payment Services and describes the features and use. Chapter 4 Transaction Funding provides the information needed to assure a prompt, accurate remittance to Citibank Europe to fund your WorldLink Payment Services transactions. Chapter 5 Reconcilement identifies information provided to your organization for reconcilement and indicates the types of reconcilement that WorldLink Payment Services performs. Chapter 6 Service Requests provides information for making customer service requests stop payments, photocopies, transfers and ACH recalls, as well as information on how to determine payment status and obtain refunds. Terminology The Glossary, which is found at the end of this Management Guide, provides definitions of abbreviations and terms used in this Management Guide and in your use of WorldLink. Definitions of the following terms, which are used throughout this Management Guide, are also included here near the front in order to add clarity to your reading. Payment. A disbursement to a client s beneficiary. Payment Instruction or Payment Order. Electronic information instructing Citibank Europe to effect a payment on the client s behalf. Funding. The act of paying Citibank Europe for WorldLink Payment Services transactions. Remittance. The total daily funding amount due to Citibank Europe for a client s WorldLink Payment Services transactions. Remit Option. The date when available funds for your WorldLink transactions are due. Using This Guide This Management Guide provides information for the folowing WorldLink payment types: On-Site Check, Remote Check, Funds Transfer, Cross Border ACH payments, and Cash. It also describes the various communication methods for providing your organization s payment instructions and information to WorldLink, whether via CitiDirect Online Banking, file transmission, or SWIFT. You need only refer to those sections that address the WorldLink payment products and services used by your organization for effecting payments. It is a good idea to review this Management Guide to familiarize yourself with its contents and organization. Thereafter, you will want to use this Management Guide as a reference for the particular WorldLink products and services you use. 1

6 Audience. The guide is directed to all individuals who want an overview of WorldLink Payment Services and to those who have overall responsibility for managing and administering WorldLink payments in your organization. Additional Documentation In addition to this Management Guide, Citibank Europe also provides the following documentation for your reference: WorldLink Payment Services Reference Booklet. The WorldLink Payment Services Reference Booklet (the Reference Booklet ) contains detailed currency and bank information, a customer support directory, and other important reference information. The latest version of this Management Guide, the Reference Booklet and other informational documents regarding WorldLink are maintained on the WorldLink Online Reporting system. The WorldLink Online Reporting system can be accessed through Alternatively, the site can be directly accessed via: 2

7 1 Overview WorldLink Payment Services offers a complete cross-border payments system serving clients worldwide. With WorldLink Payment Services, your organization can issue payments in over 130 currencies and make remittances for those payments in one or more currencies designated by you. Thus, you can participate fully in the global marketplace without having to maintain an account in every currency you issue. When you sign up for WorldLink Payment Services, you select the payment types your organization will issue, the communication method or methods you will use to deliver payment instructions and information to WorldLink, your funding method and funding currencies, and remit option. A recap of this information is provided to you prior to start -up. This chapter identifies the payment types that can be issued via WorldLink Payment Services, summarizes the communication methods WorldLink supports, and describes the phases of payment processing. Subsequent chapters provide more detailed information. Governing Law Unless otherwise agreed, any action or dispute regarding payments initiated through WorldLink Payment Services are governed and interpreted by the laws of England. In addition: Each Cross Border ACH payment is also subject to any applicable local clearinghouse rules. The Operating Rules and Guidelines of the (U.S.) National Automated Clearing House Association ( NACHA ) require originators of transactions to agree to such rules and guidelines. Therefore if you request a U.S. ACH payment, you expressly agree to the rules of NACHA. With respect to any check issued, the laws of the country in which the check is presented for payment, as indicated by the payable at location on the face of the check, will govern the handling of the check for all purposes, including presentment, payment, collection, stopping or return. To the extent your organization may be able to claim sovereign immunity from the jurisdiction of any court or legal process (including relief by way of injunction or specific performance), you agree to irrevocably waive such immunity with respect to your WorldLink obligations and further waive any defense in connection with immunity your organization may have against the enforcement of any judgment rendered by any court in respect of WorldLink Payment Services. You cannot assert any claim against Citibank Europe relating to WorldLink Payment Services or any WorldLink payment more than one year after such claim shall have accrued. The terms and information provided in this Management Guide are for the benefit of you and Citibank Europe (including any of its Affiliates perform ing the WorldLink services), and no other person shall have any right under the Contracts (Rights of Third Parties) Act 1999 to enforce any of its terms. Local Taxes on Funds Transfers A payment to offshore beneficiary based on your instructions may necessitate the payment of withholding taxes, VAT and other taxes or governmental charges and/or other legal or regulatory reporting, all of which remain your responsibility. The tax or any governmental charge will be paid by you, and in addition you should forward to Citibank Europe plc, 1 North Wall Quay, Dublin, Ireland, Attention: Chief Financial Officer the original receipt acknowledging payment of such tax or charge. Any payment to Citibank Europe should be increased so that the net amount received is equal to the amount it would have received had no such tax or charge been due. If Citibank Europe is required to make any payment on account of a tax (excluding taxes imposed on and calculated by reference to our net income) or otherwise on or in relation to any sum received or receivable from or on behalf of you or any liability in respect of any such payment is asserted, imposed, levied or assessed against Citibank Europe, you will indemnify Citibank Europe, when requested, against such payment or liability, together with any interest, penalties, costs and expenses payable or incurred in connection with the payment. 3

8 Payment Types According to your organization s agreement with Citibank Europe, you have been authorized to issue one or more of the following payment types: WorldLink Funds Transfers. These are electronic payments that you request WorldLink to effect on your behalf. WorldLink Funds Transfers can be issued in over 130 currencies. WorldLink Remote Checks. These are checks that you request WorldLink to issue on your behalf. Citibank Europe is the drawer. WorldLink Remote Checks can be issued in over 30 currencies. WorldLink On-Site Checks. These are checks that you issue from your own offices on WorldLink Payment Services check stock. They are drawn on a Citibank-designated payable-at bank. Your organization is the drawer. WorldLink On-Site Checks can be issued in 16 currencies. Restrictions may apply on the usage of On-Site Checks depending on local country regulations. Cross Border ACH Payments. These are electronic payments that you request WorldLink to effect on your behalf. They are used primarily for non-urgent (minimum two-day value), predicable payments. Cross Border ACH payments can be issued in eight currencies covering 18 countries. WorldLink Cash *. These are cash payments that you request WorldLink to effect on your behalf. They are used primarily for urgent low value same day cash payment needs. A beneficiary can collect funds in 190 countries and territories and over 220,000 locations worldwide. Chapter 3 describes each payment type in greater detail. For a list of the payment currencies available for each payment type, see the WorldLink Payment Services Reference Booklet. Communication Methods WorldLink instructions and information can be transmitted for processing via CitiDirect Online Banking, file transmission, or the SWIFT network. Each communication method is described in separate documentation relating to that particular method. CitiDirect Online Banking WorldLink Payment Services CitiDirect Online Banking is a browser-based application accessed through CitiDirect. Remote Checks, On-Site Checks, Funds Transfers and Cross Border ACH can be initiated through this delivery channel. File Transmission File transmission is a batch or bulk payment initiation method. It enables you to build a file of payment instructions from information derived from your accounts payable or other systems and then transmit the file directly to WorldLink for processing. WorldLink returns payment and other information to you via a file transmission or, in some cases, via the Internet. Remote Checks, Funds Transfers, and Cross Border ACH payments can be initiated via file transmission. You can also use a file transmission to notify Citibank Europe of your On-Site Check issuance. SWIFT Available only to financial institutions that are members of SWIFT (Society for Worldwide Interbank Financial Telecommunications), WorldLink payments through SWIFT allows these institutions to send payment instructions, reconcilement information, and customer service requests via SWIFT messages. Remote Checks and Funds Transfers can be initiated via SWIFT. You can also use SWIFT to notify Citibank of your On-Site Check issuance. * WorldLink Cash is offered via Western Union 4

9 Processing Summary WorldLink Payment Services provides a simple way for organizations to make foreign currency payments directly from their offices, regardless of the currency. WorldLink Payment Services offers a large number of frequently traded and exotic currencies for your payments. See the Reference Booklet for the currencies available for each payment type. There are four components to WorldLink processing: Your Organization Payment Initiation Create and authorize payments, obtain foreign currency exchange contracts, and transmit payment instructions and other information to WorldLink. Transaction Funding Remit funds to cover your transactions. Citibank Payment Execution Effect payments to beneficiaries according to your instructions. Reconcilement Reconcile issuances, remittance, and paid item information. The following sections describe each of these components. Payment Initiation Create Payment Instructions Authorize Payments Obtain Foreign Currency Contracts Print On- Site Checks Transmit to WorldLink Payment initiation can be via CitiDirect Online Banking, batch electronic files created by your organization to Citibank s specifications, or the SWIFT network. Regardless of the communication method, your in-office payment processing consists of the following activities. The order in which you perform the activities may vary by communication method and your organization s operating preferences. Create Payment Instructions. Payment instructions provide information about the payment, including the payment type, beneficiary, payment amount and currency. Also included are the currency being used to fund the transaction, mailing instructions (for a Remote Check) and transfer instructions (fora Funds Transfer Cross Border ACH or Cash* payment). For CitiDirect Online Banking, your payment instructions can be provided in a variety of ways: free form entry, use of a preformat (a predefined template of payment information), or data imported from another computer system. The entry alternatives can be used interchangeably and are under the control of your organization. For file transmission, you create data files according to the file specifications you have been provided. For SWIFT, you create MT 103 messages for Remote Checks and Funds Transfers, and MT 110 messages to advise WorldLink of your On-Site Check issuance. Cross Border ACH payments cannot be issued via SWIFT. Authorize Payments. WorldLink recommends that a designated person or persons in your organization other than the person who created the payment instruction (or last modified it) authorize the payment for release to be processed. CitiDirect Online Banking provides functions for authorizing payments and designating which users can act as authorizers. For file transmission and SWIFT, your organization must ensure that the payments are approved for processing before they are released to WorldLink Payment Services. 5

10 Obtain Currency Contracts. Whenever the payment currency and the funding curency are different, a currency purchase is involved. You may obtain currency conversion rates and contracts to cover your funding requirements in one of these ways: o Automatically via the WorldLink Online Rate ( OLR ) facility o Receiving daily rate quotations from WorldLink Payment Services o Calling a WorldLink currency specialist directly o Automatically as part of the payment processing via WorldLink (for file transmission and SWIFT only) The method or methods available for your use are determined by the communication method and your arrangement with WorldLink Payment Services. For additional information on purchasing foreign currencies, see Chapter 4 Transaction Funding. Print On-Site Checks. If your agreement includes On-Site Checks as a payment type and you have On-Site Check issuances, print the checks on the WorldLink check stock provided to your organization. Transmit to Citibank. Your payment instructions and other information must be transmitted to Citibank Europe so that WorldLink Payment Services can act on that information. For payment instructions for Remote Checks, Funds Transfers, Cross Border ACH and Cash payments, WorldLink effects the payments according to your instructions. For On-Site Checks, the information you provide is used to begin the status tracking and reconcilement process. If your organization funds its transactions via an automatic debit, the debit is initiated based on the information transmitted. The timing for each of these activities proceeds according to your payment instructions and remit option. Transaction Funding Depending on the communication method you use and your arrangement with Citibank Europe, you may fund your transactions via an automatic debit to one or more of your organization s bank accounts or via a manual remittance. For the current list of acceptable funding currencies, see the WorldLink Funding table in the WorldLink Payment Services Reference Booklet. If you fund via an automatic debit, you designate by payment the specific funding account that should be debited for that payment. Citibank Europe uses this information in creating the automatic debit instruction. A single debit is made to each funding account regardless of the number of transactions against that account. If you fund via a manual remittance, you designate the funding account generically by the funding currency in which you will make your remittance and make a single remittance to WorldLink in that funding currency. Chapter 4 contains further information on transaction funding. All amounts remitted to Citibank Europe by the client to cover payments are the property of Citibank Europe and are not deposits of the client. Nothing herein shall constitute Citibank Europe an express or resulting trustee for the client. Reconcilement WorldLink reconciles transactions, currency purchases, funding, and clearing. Your organization is also notified of discrepancies. Various reports are available for your own reconcilement activities. If you fund WorldLink via an automatic debit, your account statement for each funding account provides debiting activity against that account. Customer Assistance A variety of groups within Citibank provide customer assistance. Collectively, the staff in these groups are called Citibank Representatives. The Customer Support Directory in the Reference Booklet provides addresses, telephone numbers, and hours of operation for each group. In addition to contacting your Citibank Representative, CitiDirect Online Banking provides a service module, which includes a full range of customer assistance. This module can be utilized not only by CitiDirect users, but also if you use file or SWIFT to communicate payment instructions. The module includes the following capabilities: Initiating a stop payment. Payment status inquiries. Photocopy requests. 6

11 Processing refunds. Initiate a transactional query through CitiDirect Online Banking. United States Regulations Related to WorldLink Payment Services U.S. Trade Sanctions and Embargoes If you request a check, electronic payment, or cash payment which would violate U.S. trade sanctions, Citibank Europe is required to withhold the transaction and to impound your remittance. Likewise, if Citibank Europe becomes aware (for example, through clearing) that an On-Site Check you have issued violates U.S. sanctions, Citibank Europe is required to impound the remittance and the check. As a wholly owned subsidiary of a United States financial institution, Citibank Europe is prohibited from transferring funds, regardless of currency, to any country, organization, or individual who is subject to U.S. economic sanctions ( sanctions target ). This is true regardless of the resident country of the payment originator. You must refrain from using the services of Citibank Europe to facilitate commercial or financial ransactions t with, or directly or indirectly for the benefit of any sanctions target. Unless a transaction is authorized by a special or general license from the United States government, any requested Remote Checks or Funds Transfers which are destined forany sanctions target will not be completed and, in most circumstances, Citibank Europe is required to seize the funds and place them in blocked accounts. Citibank Europe is also required to block the funds you have remitted for checks sent to any sanctions target. Once the funds are blocked, they cannot be released unless your organization applies for and receives a license from the Office of Foreign Asset Control. It is Citibank Europe policy that clients must apply for a license themselves. You may obtai n information on economic and trade sanctions and copies of needed forms from the OFAC site at on the Internet. Contact your Citibank Representative if you require any clarification regarding procedures in handling these transactions. If you have any questions concerning U.S. trade embargoes and controls or the procedure for obtaining U.S. Governmental licenses, you should consult your legal counsel. In addition, Citibank Europe clients are subject to the sanctions imposed by any country where a Citibank branch is located. Should the U.S. sanctions overlap with those of another country, the stricter restrictions of the two countries will be enforced if permitted by U.S. law. If you are sending a payment to an organization, a country, or a national of a country that you believe may be subject to sanctions, you should consult your legal counsel before sending funds to that country or national of that country. U.S. Travel Rule The U.S. Treasury has implemented a regulation called the Travel Rule in an attempt to curtail money-laundering transactions in the U.S. The Travel Rule requires that additional information travel with the payment in order to aid law enforcement in tracing such transactions. If money laundering is suspected, law enforcement will have a single source to locate: Original ordering client (originator) of the transfer. Originator s bank. Beneficiary. Beneficiary s bank. Scope of the Travel Rule The Travel Rule applies to all methods used to move funds initiated by the following organizations. For WorldLink, these methods are Remote Checks and Funds Transfers. 7

12 Financial institutions and certain non-bank financial institutions ( NBFIs ) involved in money transmittals that are subject to the U.S. Federal Bank Secrecy Act regulations. Examples of NBFIs are securities brokers/dealers, money transmitters and remitters, exchange houses, and all other organizations that transfer funds for clients. Financial institutions operating on U.S. soil, U.S. territories, or U.S. possessions. Travel Rule Exceptions/Exemptions Your organization does not have to provide Travel Rule information if your transaction meets any of the following criteria: The transfer is less than 3, USD equivalent. It is a debit transaction. It is a transfer where both the Originator and Beneficiary are any of the following: o o o o o o o o A U.S. domestic bank A wholly owned U.S. domestic subsidiary of a U.S. domestic bank A U.S. domestic broker or dealer in securities A wholly owned U.S. domestic subsidiary of a U.S. domestic broker or a dealer in securities The United States government A U.S. state or local government A Federal, state, or local government agent or instrumentality The same person and their banks are the same domestic bank Contact your legal counsel for clarification as to whether your organization must comply with the Fed Travel Rule and for advice on whether a particular transaction requires Fed Travel IDs. 8

13 2 Security Preview The security of transactions processed via WorldLink Payment Services depends on both Citibank Europe and your organization. Citibank Europe has instituted multiple safeguards to protect the confidentiality and integrity of your processing. You must be equally diligent in maintaining security during your use of WorldLink. This chapter discusses security. Citibank Europe Security Procedures Citibank Europe s security procedures are designed to verify the authenticity of an electronic communication that is, that the data you sent is the data received and not to detect errors in transmission or content such as discrepancies between account numbers and names. Citibank Europe uses codes, passwords, and security devices to verify the authenticity of information, instructions, orders and other communications sent by your organization to WorldLink and by WorldLink Payment Services to your organization. If you request payments by electronic messages (including electronic banking, internet banking or the transmission of electronic files), Citibank Europe will subject each request message to agreed security procedures, but is authorized to process any payments requested in messages, which comply with our security procedures. Citibank Europe cannot check the contents of each message and you are responsible for the contents and the conformity to any required formats. Many of Citibank Europe s security provisions are part of its internal operating procedures. The following provisions, however, affect the security and integrity of your payment instructions directly. Client Number WorldLink clients receive a unique identification number for use in processing WorldLink payments. This identification number is used to verify that the source of a payment instruction is a valid source and in WorldLink s payment reconcilement and tracking processes. Your client number is provided to you prior to start-up. Your client number appears on your On-Site and Remote Checks, in the electronic messages transmitted to WorldLink Payment Services, and in the communications you receive from WorldLink. You should use your client number on your remittances and for all your communications with WorldLink. Transaction Reference Number For CitiDirect Online Banking, a transaction reference number is assigned to each payment you initiate. For file transmission and payments via SWIFT, your organization assigns a transaction reference number to each payment request you initiate. These reference numbers allow WorldLink to track and report each payment and to provide customer service, as necessary. Whenever you have a question about a particular payment or need customer service concerning a payment, you must include its reference number in your request. WorldLink Check Security The check stock used for Remote Checks and the stock provided to your organization for On-Site Checks is a high-quality form with many security features incorporated to protect against fraud and counterfeiting including but not limited to: Fluorescent ink and fibers. Chainlink watermark. Chemical sensitivity. Toner grip. 9

14 Void pantograph. Once printed, each check has a unique nine-digit check number (serial number). This check number enables Citibank Europe to provide the following services for each check issued: Tracking the check. Providing you with the status of the check. Accounting for voided checks. At your request, initiating a stop payment on the check. Verifying that the check presented for payment matches the issuance information you submitted. Monitoring your check inventory so that it can be replenished when it begins to run low. Match Pay items match the amount of the check against the issuance received. Whenever you have a question about a particular check or need customer service concerning a check, you must provide the nine-digit check number of the check in question. For Remote Checks, you may provide the transaction reference number instead. WorldLink Cash Security When the beneficiary collects the cash from a Western Union agent, he/she will be required to identify the sender, location of origin and approximate amount to be received, present a valid government-issued photo ID, and may be required to answer a test question. In some locations, the beneficiary will be required to provide Western Union s MTCN (Money Transfer Control Number). You are advised to check the requirements in the WorldLink Cash Country Service listing, as they may differ by country. WorldLink Cash payments are low-value urgent payments, with a USD7,300 equivalent limit per payment. Please note, local country laws may further limit payment amounts. Therefore, prior to initiat ing a Cash payment, please refer to the WorldLink Cash Country Service listing for guidelines. Currency Purchase Contract Rate Confirmation When you receive a contract number for a currency purchase rate quotation, that contract number is your confirmationthat you have accepted the rate and that the contract appears in WorldLink s records. For a forward contract rate, you are sent a confirmation letter, which you must sign and return. In addition, telephone conversations between you and a Citibank Representative regarding currency purchase quotations are recorded, as is customary practice in currency trading worldwide. This practice protects everyone in case of a miscommunication. Message Transmission Security File Transmission Citibank Europe requires all electronic messages it receives from file transmission to be encrypted. To protect a communication session against attacks, the data must be software encrypted. Software encryption provides the following services: Establishes the authenticity of the initiator to the target and the authenticity of the target to the initiator when the communications session is started. Ensures that the authenticity of the initiator and target established at the beginning of the protected session is maintained throughout the duration of the secured session. Protects the integrity of messages by calculating cryptographic checksums. Authenticates the identity of a message sender through the use of digital signatures. 10

15 Protects the confidentiality of messages through encryption techniques. Detects whether a message has been received before or whether it is being received out of sequence. WorldLink via CitiDirect Online Banking WorldLink via CitiDirect Online Banking additionally provides firewalls, web access control, and non-repudiation to further protect your organization s data. Firewalls. A firewall consists of hardware and/or software that form a security system to control access into or out of a computer environment. Web Access Control Mechanisms. Working with firewalls and software session encryption, web access control mechanisms manage these security items for communications between your browser and the CitiDirect Online Banking server. Authentication. Authentication is the means of providing user or system identities throughsuch mechanisms as user name/password pairs, digital certificates, and smart cards. Data privacy and integrity. Encryption is used to ensure that information is kept confidential and that it is not changed during transit. Auditing and logging. Auditing provides the means of tracking security-related events. Management. WorldLink offers the ability to administer security permissions, users, and groups. Non-repudiation. Non-repudiation is the means of proving that a user actually sent the data received. It ncludes i the following: o o Private key security. Only the authorized user has the private key for decryption Digital signatures. A digital signature appears in all encrypted files or messages SWIFT WorldLink Payment Services via SWIFT is offered to its clients who are SWIFT members. The data security and integrity for this option are based on Citibank Europe s policies, which comply with SWIFT rules, and your institution s policies surrounding its use of the SWIFT network. Additional CitiDirect Online Banking Security Features Access Controls WorldLink Payment Services via CitiDirect Online Banking provides additional security by offering flexibility in these access control features: User profiles and entitlements. IDs and passwords. Software time outs. Audit trails. Authorization required for security changes. The implementation of these features varies by your organization s requirements and is detailed in the CitiDirect Online Banking documentation. User Profiles and Entitlements User profiles and entitlements identify users and define the functions and processes they are allowed to use. For example, some users may be restricted to entering payments only through preformats (payment templates for repetitive payments). A user may be restricted to entering payments no greater than a specified amount. Or a user may be designated as an authorizer. 11

16 IDs and Passwords Each user is identified by a user ID. Each action logged to the audit trail includes the user ID of the person who caused the action. Each user requires a password to sign on to the software. CitiDirect Online Banking users are given a Safeword Platinum card, which they use to generate a one-time only (dynamic) password. Software Time Outs If the WorldLink Payment Services application is idle for a pre-set amount of time that is, the user has not used the keyboard or mouse within that period the software automatically signs off that user. Audit Trails Through a variety of reports and event logs, you can monitor security and non-financial events for possible security violations. Payment Security WorldLink via CitiDirect Online Banking offers you flexible payment security features that help safeguard your transaction issuance. With payment authorization you have maker-checker controls over payments. These authorizations can be set by payment type, and can be multi-level. Your installation can restrict users to initiate payments only from a library of repetitive payments called preformats. Another way to restrict entries is to require users to select from field libraries for beneficiaries, mailing addresses, beneficiaries banks, and intermediary banks. If your organization has multiple operating entities, you can restrict a user to processing for only the entity specified in his or her user profile. Your Security Provisions You must include these security provisions in your procedures for your use of the WorldLink system: Establishment of a secure environment and security procedures for the communication method you are using, including: o Maker-checker control via independent authorization for Remote Checks, Funds Transfers, and Cross Border ACH payments o Systematic record keeping and reporting through such methods as payment records, audit trails, access logs, and so forth o Prompt reporting to WorldLink of fraudulently requested Funds Transfers, Remote Checks, and Cross Border ACH payments o Establishment of a secure environment and security procedures when importing payment instructionsinto CitiDirect Online Banking If you issue On-Site Checks you must: Establish a secure environment and security procedures associated with receiving and storing WorldLink On-Site Check stock, including but not limited to: o o o o o Daily accounting by all check issuers of the checks they issued Physical inventory reconcilement of check stock Prompt reporting to WorldLink Payment Services of lost, stolen, destroyed, or unauthorized On-Site Checks Prompt response to notices of paid, unadvised items ( PUA ) Destruction of On-Site Check inventory upon termination of the use of WorldLink Payment Services, or a change in your check format. You must supply WorldLink with a destruction certificate identifying the serial number of each On-Site Check destroyed 12

17 3 Payment Types Preview WorldLink Payment Services include the following types of cross-border payments. The types of payments that WorldLink will process for your organization depends upon the communication method you use and your agreement with Citibank Europe. WorldLink Funds Transfers. Electronic payments that you request WorldLink Payment Services to effect on your behalf. Over 130 currencies are available for Funds Transfers. WorldLink Remote Checks. Checks that you request WorldLink Payment Services to issue on your behalf. Over 30 currencies are available for Remote Checks. WorldLink On-Site Checks. Checks that you can initiate, print, and release directly from your offices. Over 16 currencies are available for On-Site Checks. Cross Border ACH Payments. Low-value clearing payments that you request WorldLink Payment Services to effect on your behalf. Eight currencies covering 18 countries are available for Cross Border ACH payments. WorldLink Cash. Allows you to send urgent low value cash payments in 190 countries and over 220, 000 locations worldwide. The Reference Booklet lists the current currency offerings by payment type. WorldLink Funds Transfers This section is applicable to your organization if you have been approved to use Funds Transfers as a payment type. A Funds Transfer is an electronic payment that you have requested WorldLink to effect on your behalf. When you initiate a Funds Transfer, the WorldLink processing center located within the Citibank Europe funds transfer network (FTN) receives your payment instruction. The payment is enhanced with WorldLink Payment Services information needed for processing and then it is forwarded on to the appropriate processing center (currency center) based on the currency and country of the payment. On value date the currency center will place the payment into the local clearing for that currency/country and debit WorldLink s omnibus account. The clearing delivers the funds to the beneficiary bank for final credit to the beneficiary. Final credit to the beneficiary is not under Citibank Europe s control, but strictly depends on the policies and practices of the banks involved in the transfer. Citibank Europe can only guarantee that the Funds Transfer is placed into the clearing by the value date of the payment. Not all countries have electronic clearing. In this case the processing center of the country of currency may issue a check or manager s draft and hand deliver it to the beneficiary s bank for final credit to the beneficiary. Citibank Europe does not guarantee credit to the beneficiary on value date. Credit to the beneficiary strictly depends on the policies and practices of the banks involved in the payment order. There are many reasons a payment could be delayed or rejected before it reaches the beneficiary. These include, but are not limited to: Incomplete or invalid payment information such as: Beneficiary s account number in the format required by the local clearing or at the beneficiary bank. Beneficiary s full and complete name as it is on record at the beneficiary s bank. By order of party s full name and address. By order of party s account number. This account number equals your WorldLink client number, unless you are initiating the payment for another party. In that case, you must include the party s account number with you in the by order of field. 13

18 For example: If Citibank, N.A., the WorldLink client and identified with client number 12345, sends a Funds Transfer by order of Smith Barney (SB), Citibank, N.A., must include SB s account number with Citibank, N.A., in the by order of field. Missing Intermediary Bank details. If the beneficiary bank is not a member of the local clearing for the currency, you are required to provide the intermediary bank details of a bank that is a member of the local clearing. Invalid formatting of the payments instructions based on currency/country requirements. Many countries require specific formats for a Funds Transfer to clear. Others require specific information be included in the payment instruction. For example: The Central Bank of Thailand provides a list of reason codes, and requires that one of these codes is included in every payment instruction. The Reference Booklet lists the current formatting requirements for structuring funds transfer payments. Not passing OFAC screening. As mandated in the United States and the country of clearing of the Funds Transfer. Supplying complete and accurate information will significantly reduce the chance of delays in processing the payment. Same Day/Next Day Currencies. WorldLink Payment Services offers same day/next day funds transfers on a commercially reasonable basis. The ability to provide credit to the beneficiary bank on value date is subject to a variety of factors, including but not limited to, receipt of instructions by applicable cutoff time, proper funding, sufficient credit, ability of beneficiary bank to receive electronic funds transfers, and intervening holidays and non-business days in country of currency. Funds Transfer instructions requiring repair may be delayed. Your organization must be approved to use the same day/next day currency option. In addition, your delivery channel must specifically allow for this and the facility is restricted to certain currencies. Sending Funds Transfers Charges When you initiate a Funds Transfer request, the Funds Transfer is sent to the beneficiary s bank for payment to the beneficiary. The Funds Transfer may be routed through an intermediary bank. On each Funds Transfer instruction, you have the opportunity to indicate how all charges, fees and other costs assessed by any correspondent bank or financial institution involved in effecting the Funds Transfer should be charged. Charge Our indicates you will pay the charges as the initiator of the Funds Transfer. In this case these charges will be included on your WorldLink Payment Services invoice. Charge Bene indicates the changes will be borne by the beneficiary of the Funds Transfer. Charges will be deducted from the final proceeds credited to your beneficiary. Charge Share indicates that the charges will be borne both by the initiator and the beneficiary. The initiator s portion of the charges will be included in your WorldLink Payment Services invoice. The availability of the shared charges option is dependent on platform and on currency restrictions. In connection with each Charge Our transfer, you are responsible for all charges, fees and other costs assessed by any correspondent bank or financial institution used to effect such transfer, unless specifically agreed to in writing. All such charges, fees and costs are in addition to the transaction fees charged by WorldLink for effecting your payment requests. All Charge Our fees and costs are payable upon demand. Bene Deduct is an option available to Financial Institutions. With beneficiary deduct, a client can instruct Citibank Europe to reduce the amount of the Remote Check of funds transfer to cover their transaction fee by listing BEN in field 71A. Beneficiary deduct makes the transaction free to the client, as Citibank Europe essentially collects its fee from the beneficiary. Prompt Reporting of Fraudulently Requested Transfers As soon as you discover that a requested transfer has been fraudulently requested, immediately notify your Citibank Representative and describe the problem. WorldLink Payment Services will attempt to cancel or recall these items but it may not be able to do so. 14