Applied Risk Management

Transcription

1 THE PAYMENTS INSTITUTE July 20-23, 2014 Emory Conference Center Hotel, Emory University, Atlanta, Georgia Applied Risk Management Norman Robinson, AAP. CTP President & CEO EastPay, Providing Payments Expertise

2 Course Outline Understanding approaches to risk management and methodologies Review 9 elements of risk Review Cross-Channel Risks Review Enforcement & Arbitration Class exercises on risk case studies Present and review case study conclusions 2

3 Learning Objectives 1. Review fundamental concepts of risk management 2. Discussion of two approaches to payment system risk management 3. Apply concepts learned to case studies with class review and discussion of case studies 3

4 Risk Management Review Two Approaches Structured approach Self assessments Indicators Scenarios Dash board Enterprise approach Strategic view Overarching Driving Not mutually exclusive 4

5 5

6 Assessments Structured approach to risk assessments Tools to gauge: Risk tolerance Mitigation Effectiveness 6

7 Structured Approach Identify risk factors in each functional area such as: Deposit operations New accounts Teller operations Wire transfer ACH RDC Internet banking 7

8 Methodology Apply numeric factor for each risk element 1 to 5 where 1 is low and 5 is high Apply numeric factor for mitigants 1 to 5 where 1 is high and 5 is low Multiply factors High score = high risk Define acceptable scores 10 or lower = acceptable 11 to 15 = moderate 16 to 25 = unacceptable 8

9 Example Customer can initiate outbound wire transfers through on-line banking platform Risk customer may be able to make over limit transfers Risk factor = 5 (high) Risk mitigation assessment determines that: Pre-set limits are monitored by system Over limit transactions are suspended Dual approval is required to release transactions Over limit transactions are call back verified with customer Risk mitigation score = 2 (medium high) Risk score = 10 (5x2) acceptable 9

10 Example Customer can initiate wire transfers through on-line banking system Risk customer may be able to make unauthorized transfers Risk factor 5 (high) Risk mitigation assessment determines that: Multifactor authentication is weak for this application Example: user name and password only Encryption of data is below current RSA standards Customer s PC is susceptible to malware No pattern detection software is deployed Inadequate verification process Risk mitigation score = 4 (medium low) Risk score = 20 (5x4) unacceptable 10

11 Enterprise Approach One office responsible for ALL risks Including all aspects of operational risk View risk holistically for the enterprise Build linkages between risk categories Dynamic linkage, not static single point assessments Use assessments as the dashboard but relies on other input channels Looking up and around driving 11

12 12

13 Elements of Enterprise Risk Financial Interest rate Pricing Liquidity Management Strategic Credit Reputation Business & legal Operational Transactional Operational 13

14 Cross-Channel Risk Risk associated with deposit accounts by way of multiple points of access branch, ATM, call center, debit card, online banking, check, ACH, wire, etc., or the presence of multiple risk types. Legal Reputational Operational Compliance Fraud Liquidity 14

15 Managing Cross Channel Risk U.S. Payments Industry Risk Management Initiatives The Financial Services Roundtable Banking Industry Technology Secretariat (BITS) Financial Services Technology Consortium (FSTC) Early Warning Systems The Clearing House Payments Company NACHA Cross Channel Risk Certification 15

16 Credit Risk Occurs when a party to a transaction cannot provide the necessary funds, as contracted, in order for settlement to occur 16

17 ODFI Credit/Exposure Risk ODFI Credit origination Risk is the Originator will fail to fund the ODFI for credits The ODFI is exposed from the time the ACH File is transmitted until the ODFI receives funding from the Originator/Third-Party Sender ODFI Debit origination The ODFI is exposed to risk from the time the funds from the debit entries are released to the Originator/Third-Party Sender until the statute of limitations expires under applicable state law 17

18 Exposure Risk Credit File DAY 1 DAY 2 DAY 3 Originator deposits $3mm Direct Deposit Payroll file with the ODFI The ODFI transmits the file to the ACH Operator by noon RDFI makes funds available at opening of business Receivers withdraw funds from accounts At 1:30pm, the Originator files for Chapter 11 protection ODFI experiences a potential $3mm loss 18

19 Exposure Risk - Debit File Day 1 $100,000 file Day 2 settlement Risk = single transactions or entire file Day 3 Day 4 return items exposure Day 60 Consumer debits returned unauthorized & revoked 19

20 ODFI Credit/Exposure Controls Determine creditworthiness and exposure limits for Originators and Third-Party Senders and review periodically Assess the nature of the Originator s and Third- Party Sender s activity and the risk it represents Through prefunding, ODFI can significantly reduce credit risk Monitor the Originator s and Third-Party Sender s origination and return across multiple settlement dates 20

21 ODFI Credit/Exposure Controls Establish clear policies and procedures to deal with over limit transactions Perform ACH Rules Compliance Audit annually Address in Originator and/or Third-Party Sender agreement: Restrictions on the types of ACH transaction that may be originated Right to terminate or suspend Right to audit 21

22 RDFI Credit/Exposure Risk RDFI Credit receipt Risk is related to the time of settlement finality granted by the ACH Operator RDFI Debit origination The risk to the RDFI is the failure to meet return time frames otherwise, may result in a loss for the RDFI 22

23 Rules Enforcement Governed by Appendix 10 of the NACHA Operating Rules Applies in the event of an alleged ACH rules violation A rules enforcement proceeding may be initiated for any violation To initiate a rules enforcement proceeding, a participating DFI or the National Association must submit a Report of Possible ACH Rules Violation to the National Association 23

24 Rules Enforcement A Report of Possible ACH Rules Violation must: Be submitted within 90 days of the occurrence of the rules violation Identify the parties involved in the dispute Summarize the facts surrounding the dispute Provide documentation supporting the claim of a rules violation Be signed by an authorized representative of the complainant 24

25 Rules Enforcement A Report of Possible ACH Rules Violation must be completed for each violation asserted against a Participating DFI Each Report of Possible ACH Rules Violation is reviewed by the National Association to determine whether an infraction of the rules appears to have occurred 25

26 Rules Enforcement NACHA will send a Notice of Possible ACH Rules Violation to the Respondent (traceable delivery method), the incident is defined and the respondent is requested to investigate The respondent must reply (traceable delivery method), within 10 Banking Days of receipt of the Notice of Possible ACH Rules Violation, stating either (1) that it acknowledges the violation and will correct it by a specific date (the resolution date), or (2) that it refutes the alleged violation 26

27 Rules Enforcement If the respondent submits the required response form within the appropriate time, no further action will be taken by NACHA If no response is received, NACHA will send a Notice of Possible Fine to the respondent, again outlining the rules violation and requesting a response from the Participating DFI Failure to respond is considered a Class 2 violation 27

28 Rules Enforcement The respondent must reply, within 10 Banking Days of receipt of the Notice of Possible Fine, stating either (1) that it acknowledges and will correct by a specific date, or (2) that it refutes the rules violation 28

29 Rules Enforcement Notice of Possible Fine will also be sent to a Participating DFI if the respondent is cited with a recurrence of a rules violation that the DFI previously indicated was resolved A rules violation is considered to be a recurrence of a previously reported infraction of the rules if the same infraction is committed within the one-year period following the resolution date of the initial rules violation 29

30 Rules Enforcement Fines The first recurrence of a rules violation that causes a fine to be levied will result in a fine up to $1,000 against the Participating DFI The second recurrence of a rules violation that causes a fine to be levied will result in a fine up to $2,500 and the third up to $5,000 Class 1 Rules Violations involve a recurrence of a previous rules violation First, second, and third recurrences will be referred to as Class 1 rule violations 30

31 Rules Enforcement Fines In a Class 2 Rules Violation, the ACH Rules Enforcement Panel may levy a fine against the respondent Participating DFI in an amount up to $100,000 per month until the problem is resolved No response to either Notice of Possible ACH Rules Violation or Notice of Possible Fine The FI responds that it does not intend to correct the problem Time frame and Resolution date are excessive Violation causes excessive harm to Participating DFIs or ACH Network Fourth recurrence of a previous violation ODFI has failed to provide reporting information for unauthorized Entries as required by the NACHA Operating Rules 31

32 Rules Enforcement Class 3 Violations Fines Any case where a Class 2 violation has continued for three consecutive months, the ACH Rules Enforcement Panel may determine that the violation is a Class 3 Rules Violation ACH Rules Enforcement Panel may levy a fine against the respondent DFI of up to $500,000 per month until the problem is resolved 32

33 Rules Enforcement Suspension In circumstances where the ACH Rules Enforcement Panel has determined there is a Class 3 Rules Violation against a specific Originator the Panel may direct the ODFI to suspend the Originator or Third-Party Sender from originating In these cases NACHA will provide notice of suspension and subsequent reinstatement 33

34 Arbitration Procedures The settlement of disputes arising under these rules between Participating DFIs may be governed by the procedures contained in Appendix 9 ᅳ Arbitration Procedures of the NACHA Operating Rules Arbitration provides a low cost, expeditious mechanism for resolving disputes, bypassing the need to resolve disputes through the court system 34

35 Arbitration Procedures In order to file a claim of arbitration: Damages claimed must be $250 or more Complaint must be submitted to NACHA and include: An identification of the parties involved Summary of facts Statement of damages Documents relating to claim Application fee ($250) 35

36 Arbitration Procedures While Rules Enforcement allows an institution to report an alleged rules violation, the finding does not allow for recovery of any loss suffered Arbitration is a low-cost tool to mitigate loss without having to utilize the court system Levels the playing field among all sized institutions for amounts less than $50,000 36

37 Arbitration Procedures Arbitration Procedure A is used for complaints with damages of at least $250 but less than $10,000 Mandatory Arbitration Procedure B is used for complaints with damages of at least $10,000 but less than $50,000 - Mandatory Arbitration Procedure C is used for damages of at least $50,000 or more Voluntary 37

38 Compensation Rules Allows Financial Institutions to recover losses when an error occurs causing them to be unjustly enriched or harmed Financial Institutions should be aware that they may be subject to a compensation claim for damages including interest and penalties Claim must be at least $200 Non-refundable application fee of $200 38

39 Case Study Methodology Assess scenario Identify the risk Define strategy for dealing with risk or what should be done differently If appropriate, weight ratings on impacts and probabilities and why (be prepared to defend decision) Define the internal team that would be assembled and why 39

40 Case Studies Case studies will be distributed during class period Approx 30 minutes allocated for case study 40

41 Case Study Briefings Each group should appoint a spokesperson Briefing for each group Q&A 41

42 Learning Objectives 1. Review fundamental concepts of risk management 2. Discussion of two approaches to payment system risk management 3. Apply concepts learned to case studies with class review and discussion of case studies 42

43 Discussion & De-brief Comments Questions 43