The Unique Footprint of Emerging Risks

Transcription

1 The Unique Footprint of Emerging Risks Managing your most pressing risks CUNA Mutual Group Proprietary Reproduction, Adaptation or Distribution Prohibited 2016 CUNA Mutual Group, All Rights Reserved. What s in store for today A brief look at risk management concepts Emerging risks on our radar Action steps to take Douglas Roossien, CRM Risk Management Consultant CUNA Mutual Group Douglas.roossien@cunamutual.co m 2 1

2 Credit union business strategy Governance & Oversight Making Significant Decisions Seizing Opportunities Understanding Risk Appetite Establishing Growth Initiatives Managing Risk 3 Emerging risks New unforeseen or introduced to industry Not New manifestation & implications increasing Well-known incidence & impact becoming more aggravated Probability of Occurrence Estimated Severity (ROA impact) Risk 4 2

3 Multi-pronged approach Controlling risks Assume Avoid Prevent Spread Finance / Transfer 5 Measuring the most relevant risks Business Lending Consumer Lending Consumer Payments Cybersecurity Deposit Account Services Employment Practices Funds Transfer / ACH Internal Controls Physical Security Real Estate Lending 6 3

4 Emerging risks in credit unions On the radar Payment card fraud / ATM skimming Active shooters Social media Discrimination Employee & director dishonesty Cybersecurity Wire transfers / ACH Overdraft litigation Collection letters ATMs & ADA compliance Transportation network companies 7 Emerging risk Payment Fraud / ATM Skimming 8 4

5 Consumer payments Consumer Payments Common fraud trends < 50% of breaches are known 1 PIN-less Debit Local Fraud ATMs 546% increase in ATM Skimming occurred in 2015 on top of the 174% increase in Source: 1 Rippleshot 2 FICO, Consumer Payments ATM Skimming Foreign device attached directly to the ATM to capture data from a card s magnetic stripe All different shapes, sizes & often well-disguised Can include micro-cameras or PIN-paid overlays keypads fitted to capture keystrokes Fraudster harvests data by retrieving device or in some cases accesses the data remotely Fraudsters seek the path of least resistance 10 5

6 How to avoid becoming the weakest link? Consumer Payments Mitigation Tips Perform & document regular ATM inspections Look for foreign devices: Tape / Glue residue Skimming device PIN-pad overlay Card-trapping or Cash-trapping device Micro-cameras typically by envelope holder, above PIN pad including light fixture, security mirror, and canopy 11 Are there other things to do? Consumer Payments Consider payment cards with dynamic authentication methods such as EMV Photos to compare / contrast differences Free of concealment areas Overgrown shrubbery Adequate lighting Alarms / surveillance cameras Ability to capture movement in darkness Scrutinize ATM / gas pump transactions Staff / member awareness Anti-skimming device readers 12 6

7 Get innovative! Consumer Payments Some have created anti-skimming hardware by adding a simple drawer pull from a local hardware store to the ATM s face Always get vendor / partner sign-off 13 Get innovative! Consumer Payments Even gas stations are coming up with their own enhancements for skimming fraud 14 7

8 Consumer payments CASE STUDY Consumer Payments $900+ million credit union Variety of fraud on both debit and credit Fraud superseding expected fraud rules in place Credit union recently switched card processors $100,000+ fraud loss over weekend for online purchases Mitigation Tips Check fraud rules and parameter setting regularly to ensure alignment with risk tolerance Ensure strong authentication when removing blocks from transaction or approving overseas travel Source: CUMIS Insurance Society, Inc. 15 Emerging risk Active Shooters 16 8

9 Responding to an active shooter Physical Security Run Hide Fight Have an escape route and plan in mind Leave belongings Keep your hands visible Seek area out of the shooter s view Block entry to your hiding place Lock the doors As last resort when life is in imminent danger Attempt to incapacitate the active shooter Act with physical aggression and use/throw items An active shooter is actively engaged in killing or attempting to kill people in a confined / populated area 24.4% average increase in incidents from 2000 to 2013 Average of 11.4 incidents annually Source: 2014 FBI Bank Crime Statistics 17 Physical Security Active shooter preparedness Preparing for an active shooter incident is like trying to teach instinct. The Department of Homeland Security provides a comprehensive set of resources including articles, materials, and trainings

10 Emerging risk Social Media 19 Employees & social media activity Employment Practices Employers that discipline employees for social media activity that constitutes protected activity likely will be found to have violated the National Labor Relations Act (NLRA). Claims: Wrongful Termination Retaliation NLRA Section 7 Employees shall have the right... to engage in other concerted activities for the purpose of... mutual aid or protection NLRA Section 8 Employers cannot interfere with the exercise of this right 20 10

11 Employment Practices Managing social media risk Avoid undefined, broad terms in social media policy Provide examples of behavior to prevent Make it clear that policy is not intended to target NLRA rights and avoid appearance of prohibiting protected activities Consult an employment attorney Train employees / managers Terminate carefully 21 Emerging risk Discrimination 22 11

12 Discrimination New protected classes Employment Practices Pregnancy Religious LGBT Gender expression / gender identity Mitigation tips Review traditional protected classes Adapt credit union policies and procedures to reflect new classes Train & communicate Document all employment-related decisions 23 Pregnancy discrimination Employment Practices Ensure light-duty policies apply to employees with on-the-job injuries apply to pregnant employees too Don t have to create light-duty program pregnancy doesn t get a preference Engage in interactive procedures to determine appropriate reasonable accommodations State laws can require more of employers Safest route: accommodate whenever reasonable 24 12

13 Sexual orientation / gender identity Employment Practices EEOC has held in federal employee cases that sexual orientation/gender identity discrimination violates Title VII Federal courts already finding liability against private employers Many states and over 140 municipalities protect employees from gender identity and sexual orientation discrimination 52% EPL payments related to claim defense Source: CUNA Mutual Group internal claims data 25 Emerging risk Employee & Director Dishonesty 26 13

14 Employee & director dishonesty C-Note sandwich Theft of vault or teller cash Dishonest purchase orders/ account manipulation Fictitious/Unauthorized loans Generally speaking, employees who have a need, an opportunity, and can rationalize their actions are the ones who commit internal fraud $150,000 median loss 1 1 of 4 losses exceeds $1,000,000 1 Internal Controls 55% Bond Claim Dollars are employee dishonesty & faithful performance 2 Source: Association of Certified Fraud Examiners 1 ; CUMIS Insurance Society, Inc. internal claims data 2 27 Employee fraud CASE STUDY Internal Controls AVP/Vault teller evaded detection during surprise cash counts on vault cash Made entries to sell cash to other teller and moved funds to the ATM general ledger account Reversed entries afterwards Credit union failed to monitor cash in & cash out transactions before and after surprise cash counts Impact $826,000 lost in 10 years Source: CUMIS Insurance Society, Inc

15 Managing employee dishonesty risks Internal Controls What can you do? Strong hiring practices Segregation of duties Regular review of authority levels Dual controls Supervisory/Internal audit program (trust but verify) Frequent surprise cash counts Control access to data, information, checks, and cash 29 Emerging risk Cybersecurity 30 15

16 Cyber risks Growing severity 3.2 million records exposed nearly double from 2011 $ per record average cost to repair Employee Negligence/Theft Lost/Stolen Data Laptops, backup tapes / disks; and other data-bearing mobile devices Vendor Leaks/Mistakes Network Hackers & Malware Cybersecurity Source: NetDiligence 2015 Cyber Claims Study 31 Cybersecurity CASE STUDY Vendor exposure Vendor exposed mortgage holders PII to another financial institution Data included name, address, loan numbers, loan balance, and Social Security Numbers of mortgage holders Breach impacted mortgage holders Individuals were notified and offered credit monitoring Cybersecurity Impact Involved members in 50 states 67,000 individuals Source: CUMIS Insurance Society, Inc. & Beazley Group 32 16

17 Cybersecurity CASE STUDY Sophisticated malware attack Hackers accessed insured s system for at least six months using a sophisticated malware Fake accounts set-up & money withdrawn Member notification to with potential exposure of: Credit card numbers Social Security Numbers Driver s license numbers Impact Forensics investigation was extremely costly due to sophisticated malware used ~30,000 individuals Cybersecurity Source: CUMIS Insurance Society, Inc. & Beazley Group 33 Cybersecurity best practices Cybersecurity Protect data wherever it is located At Rest In Motion In Use What can you do? Endpoint security including firewall, anti-virus and anti-malware Up-to-date system software Encryption Ensure an incident response is in place and tested Third-party reviews and testing of network security Train staff 34 17

18 Emerging risk Wire Transfers/ACH 35 Wire transfer fraud Funds Transfer / ACH Trending HELOC accounts Pretext calling, building victim profile Online account takeover Member profile changes Member phones forwarded Destination of wires, may be mules takeovers Real estate closings Mitigation tips Monetary cap on wire requests not in person Understand coverage risk sharing/or security requirements Exceptions must be approved by officer Written agreements with members Passwords on file Avoid too much reliance on signature verification Avoid too much reliance an any documentation sent electronically Train staff to be looking for red flags 36 18

19 ACH Participants Funds Transfer / ACH Originating Depository Financial Institution ODFI ACH ACH Operator Receiving Depository Financial Institution RDFI Sponsor Other Companies ODFI itself Individual members Originator Individuals Companies RDFI itself Receiver 37 ACH Transactions Funds Transfer / ACH RDFI Receipt of ACH credits RDFI ODFI Receipt of ACH debits Origination of ACH credits ODFI Origination of ACH debits Important to understand which role the credit union is performing when problems occur 38 19

20 Summary of ACH Transactions Funds Transfer / ACH Credit union is the RDFI of Credits Funds pushed in from other institutions, direct deposit, tax refunds, etc. Not insurable if they get returned. Not a big problem area Credit union is the RDFI of Debits Funds are pulled out by other institutions, such as recurring bill payments May be insurable, but not problematic due to generous return rights Credit union is the ODFI of Credits Funds are pushed out to other institutions, online banking payments, business member payrolls Coverage typically under Electronic Crime (or Funds Transfer if by phone) if fraud Credit union is the ODFI of Debits Funds are pulled in from other institutions Currently one of the biggest Bond claim problem areas Coverage has not been available 39 ACH debit origination Types Online account opening and funding Online or mobile P2P or A2A (transfers to/from other institutions) Payments to member s credit card balance due Payments to other lines of credits Loan payoffs Loading funds to a prepaid/reloadable card offered by the credit union Business origination Controls Funds Transfer / ACH Proper ACH risk assessment to recognize types of risk Establish policies and procedures covering these transactions Implement member eligibility requirements and reasonable transaction limits (per day and per monthly) Avoid large loan payments or loan payoffs 40 20

21 Emerging risk Overdraft Fees 41 Overdraft fees Deposit Account Services Class-action litigation Allegations: Member agreement fails to properly disclose when and how fees are assessed Charging fees on available balance vs. actual balance Seeking monetary damages, restitution, punitive damages, and injunctive relief Source: CUMIS Insurance Society, Inc. Mitigation tips Review/update overdraft fee disclosures with counsel Understand how different transactions clear the system Train staff to explain how overdraft and NSF fees will be assessed Validate disclosures to practices 42 21

22 Emerging risk Collection Letters 43 Collection letters Class-action litigation Not accurate on public v. private sale (cannot be both) Items missing in the notices Improper order of items in the notice Failure to re-disclose significant changes Damages and/or penalties are generally not insurable Review/approve by legal counsel Ensure state-specific versions are developed & used for all collections activity Consider following any exemplar safeharbor form language for disposition notices Train collections staff Notices of Disposition UCC & Notices of Deficiency UCC Mitigation tips Consumer Lending Audit notices periodically for accuracy and compliance 44 22

23 Emerging risk ATMs & ADA 45 ATMs & Americans with Disabilities Act (ADA) Compliance & Litigation Risk Management ATM accessibility requirements for speech output Speech output not activated or not working properly Missing volume control, tactile symbols for function keys, privacy option, or Braille instructions Failure to have detectable warnings (sidewalk ramps and truncated domes) leading to / from ATMs as required by state building codes Perform & document ATM Inspections at least every 2-4 weeks 46 23

24 Emerging risk Transportation Network Services 47 Transportation network services Consumer Lending Ride-sharing like Uber and Lyft Private auto insurance generally excludes coverage for a vehicle when used as a livery service Identify borrowers that are using their vehicles as TNC drivers Consider requiring them to obtain a commercial auto insurance policy 48 24

25 Managing the most pressing risks Don t get caught off guard Focus on the most RELEVANT risks that impact your STRATEGIC decisions Best way to win avoid the loss/claim. Ensure oversight and review Follow a process to identify & assess risks and understand if risk controls are in place Consistently review the process and measure the success of controls Conduct a coordinated review of the risk assessment, evaluation, and measurement, including emerging risks 49 Risk assessment, mapping & measurement A few options to follow: Risk mapping matrix Risk heat map Risk table Process mapping 50 25

26 Frequency Risk mapping matrix High Frequency Low Severity LOSS PREVENTION High Frequency High Severity AVOID Frequency number of times incident/loss occurs Low Frequency Low Severity RETAIN / ASSUME Low Frequency High Severity TRANSFER / REDUCE Severity dollar impact of loss Severity 51 Risk heat map 5 Very High >100 bps 4 High bps 3 Moderate bps 2 Low bps 1 Very Low 0-25 bps Severity (ROA Impact) 0 None Probability of Occurrence None 0 Very Low 0-20% Low 20-35% Moderate 35-50% High 50-65% Very High >65% 52 26

27 Risk table Business Area Risk Impact Likelihood Inherent Risk Mitigation Residual Risk Operations Employee Theft % 5 Likelihood Frequency with which an event may occur Impact Potential magnitude of an occurrence Responses Action taken to mitigate or manage risk Mitigation Degree to which impact and/or likelihood are reduced Inherent risk Risk exposure before the credit union response Residual risk Risk exposure after the credit union response 53 Map your process to identify risks Member/Non-Member enters Main Lobby Internet Mobile Banking Telephone Branch Office Partner (e.g. Dealer) Underwriting decision MSR monitors decision Repossession occurs Inquires about loan Credit report pulled Member notification of decision Collection calls made and/or notices sent Staff identifies loan type New account and loan apps entered in system Payment insurance products offered Generation / Validation of documents Collection decision Provided new account application to complete Provided loan application to complete Loan rates, terms & payments calculated Discussion of final terms & conditions Payments Past-due reminders Loan payoff Application(s) completed and returns to MSR Membership decision Member identification is verified Loan disbursement Validate member insurance information 54 27

28 When risk management is effective, nothing bad happens and the status quo is maintained. It is extremely difficult to prove the value of nothing, so no one takes notice But if things go south and you re blindsided by a problem, the lack of risk management takes the blame. 55 Stay on top of emerging risks RISK Alerts Warning Watch Awareness Loss Prevention Library (whitepapers, checklists) Webinars & Education Risk Assessments Peer Data Protection Resource

29 Thank you for the opportunity to partner on managing risk. CUNA Mutual Group Proprietary Reproduction, Adaptation or Distribution Prohibited 2016 CUNA Mutual Group, All Rights Reserved. This presentation was created by the CUNA Mutual Group based on our experience in the credit union and insurance market. It is intended to be used only as a guide, not as legal advice. Any examples provided have been simplified to give you an overview of the importance of selecting appropriate coverage limits, insuring-to-value and implementing loss prevention techniques. No coverage is provided by this presentation/ publication, nor does it replace any provisions of any insurance policy or bond. CUNA Mutual Group is the marketing name for CUNA Mutual Holding Company, a mutual insurance holding company, its subsidiaries and affiliates. Insurance products offered to financial institutions and their affiliates are underwritten by CUMIS Insurance Society, Inc. or CUMIS Specialty Insurance Company, members of the CUNA Mutual Group. Some coverages may not be available in all states. If a coverage is not available from one of our member companies, CUNA Mutual Insurance Agency, Inc., our insurance producer affiliate, may assist us in placing coverage with other insurance carriers in order to serve our customers needs. For example, the Workers Compensation Policy is underwritten by non-affiliated admitted carriers. CUMIS Specialty Insurance Company, our excess and surplus lines carrier, underwrites coverages that are not available in the admitted market. Data breach services are offered by Kroll, a member of the Altegrity family of businesses. Cyber liability may be underwritten by Beazley Insurance Group. This summary is not a contract and no coverage is provided by this publication, nor does it replace any provisions of any insurance policy or bond. Please read the actual policy for specific coverage, terms, conditions, and exclusions. CUNA Mutual Group 2016, All Rights Reserved

30 Aligning Risk Management with CU Business Strategy appendix slides 59 30