POLICY: ACH RISK ASSESSMENT BOD Approved Date: December Purpose. Transactional Risk. Completed by and Date: Reviewed by and Date: Kristin Good

Transcription

1 eather Jones POLICY: AC RISK ASSESSENT BOD Approved Purpose The purpose of this document is to evaluate the AC risk associated with NorthPark Community Credit Union and to help maintain an AC risk management program. Transactional Risk The risk that a party to a transaction cannot provide the necessary funds, as contracted, in order for settlement to take place. Typically, credit-risk-related losses arise from the failure or bankruptcy of a company. ODFI- Exposure Dollar limit assigned to a customer, Limit representing the total amount of exposure across all services that the institution will accept. ODFI- Credit Transactions ODFI- Debit Transactions ODFI- Returns Increased risks exist when initiating an AC transaction from the time the AC batch is released until the time the funds are withdrawn. ODFI responsible for payment within two days. Increased risks exist from the time it grants the originator credit until the time frame for returns expire. ODFI responsible for settlement within one business day. Increased risks exist if the receiving account has been closed, have a negative balance, or are frozen due to bankruptcy. Unauthorized or revoked authorizations returns for AC debit items must be returned within 60 days. This 60 day return time frame greatly increases an ODFI s risk. We have a limit of $1500 per member. All of our originations are loan payments, so we are able to recover the funds by reversing the payment. Therefore our risk is moderate. We have a limit of $1500 per member. All of our originations are loan payments, so we are able to recover the funds by reversing the payment. Therefore our risk is moderate. We do not originate debit transactions. All of our AC Originations are loan payments for our members. If one is returned, we are able to reverse the payment off of the loan. Page 1

2 eather Jones POLICY: AC RISK ASSESSENT BOD Approved ODFI- igh Risk Characteristics of high-risk AC Accounts originations include unauthorized returns in excess of 1% of transaction volume, lack of a direct relationship between the ODFI and the originator, or direct access by a third party to the AC operator. ODFI- Deteriorating Credit of Existing Customers RDFI- AC Debits Deterioration of the financial stability of an existing customer resulting from economic and market trends, declining financial performance, increased debt, declining assets and decreased cash flow. Processing AC debits by allowing an AC debit to post, even if it overdraws the receiver s account. While we do originate AC transactions, we do not have any highrisk originators at this time. Therefore, our risk is low. While we do originate AC transactions, we do not have a large enough settlement to affect our financial stability. Therefore, our risk is low. Our core system automatically posts ACs if an account is setup for courtesy pay. If courtesy pay is not available, the item is returned. Both cause a fee to the member. Page 2

3 eather Jones POLICY: AC RISK ASSESSENT BOD Approved Operational Risk The risk that a transaction is altered or delayed due to an unintentional error. Examples of operational risk include loss due to clerical error or hardware and software failures. ardware Failure The failure of system equipment. Software Failure Telecommunications Failure Power Failure System disruption due to software problems, poor or slow performance of software, or insufficient software operating capacity. Telecommunications failures can range form temporary circuit outage to serious disruption of communications facilities. The failure of any component of a telecommunication facility lines, controllers, modems, authentication or encryption devices, software, etc. can impact the availability of the facility. The disruption of system operation due to a loss or fluctuation in power. stand in services in case of hardware failure. stand in services in case of a software failure. stand in services in case of a telecommunications failure. stand in services in case of a power failure. Page 3

4 eather Jones POLICY: AC RISK ASSESSENT BOD Approved uman Error Poor or miscommunication, data entry errors, and lack of pre-defined procedures including dual control of processes can result in increased operational risks and decision time frames. Staffing Problems The risk of disruptions due to staffing problems will vary according to the size of the installation and may be a greater threat in a small installation where only one or two people know AC processing or in a very large installation where each activity is so specialized very few people know the overall process. Disaster The risk of disruption due to a disaster such as a flood, fire, explosion, earthquake, civil unrest, etc. The operating site may be partially or completely destroyed, or the site may be unharmed but access to it, including surface transportation or voice or data communications, may be cut off. Corruption of AC The inadvertent loss, alteration or Data duplication of AC data, including hardware, software, or human error. This can also include the incorrect processing of an AC file received and the information contained in the file (e.g. processing dates and amounts). We have a dual process in place to verify that a stop payment was placed on an account correctly. Therefore our risk is low. Our core system s CUSO has the ability to perform our daily processing for us in the case of a staffing issue. Therefore our risk is low. Our core system posts all AC items to our member accounts. They have alternate locations, offsite capabilities, etc. Therefore our risk is low. Our risk is low, as our core system posts AC and they would be liable for such errors. Page 4

5 eather Jones POLICY: AC RISK ASSESSENT BOD Approved Fraud Risk The risk that AC data will be compromised through the introduction of false transactions, the alteration of valid transactions, or the alteration of static data that controls the routing or settlement of valid AC transactions. These fraudulent activities can be the work of disgruntled or dishonest employees, and/or outside parties (intruders or interlopers ). Fraud can also be committed by an organization (the customer). Internal Fraud Attempts to embezzle funds or steal member information to perform fraudulent transactions by employee(s) with the ability to access the AC system. Outside Parties Third Party Processing Internet Telephone Fraudulent AC transactions initiated or altered by outside parties such as system intruders, businesses and individuals working in collusion with employees. Fraud risks associated with the ODFI using Third Party Service Providers when processing AC transactions. Enables criminals to test compromised information rapidly, cheaply, and anonymously, enabling them to be more efficient in culling through stolen account numbers. Payments containing stolen account numbers may be originated into the AC network via an unsuspecting originating depositary institution (ODFI). Ultimately, the ODFI would be responsible for fraudulent transactions. Telemarketing has been associated with some unscrupulous companies and individuals using this medium for fraudulent gain. Since our core system directly processes ACs, we do not believe that our staff would be able to access the postings. Also, we perform monthly reconciliations of AC processing accounts to ensure there is no internal fraud. There is always a risk but with accounting and members reviewing accounts, risk is considered moderate. There is always a risk but with accounting and members reviewing accounts, risk is considered moderate. There is always risk for criminal transactions. We feel that our core system, members, and staff would identify this problem and make appropriate changes to prevent such transactions from occurring again. If fraud should occur, it would be due to member coercion. We try to educate our members to not give out personal information over the telephone. The Credit Union would not be liable for such transactions and therefore our risk is low. Page 5

6 eather Jones POLICY: AC RISK ASSESSENT BOD Approved Systematic Risk The risk that the inability of one funds transfer system participant to settle its commitments causes other participants to be unable to settle their commitments. Insufficient The inability of a financial institution to Capitalization fund a debit settlement due to the failure of an anticipated credit settlement, when the financial institution s capital is less than the debit settlement. Settlement Failure Chain Reaction Reversal of AC Credits The failure of one financial institution to settle causing the failure of other financial institutions to settle. This could affect the soundness of the nation s payment system. The possibility that settlement of AC credits received by the RDFI are reversed, potentially causing it to fail. CU staff review our transaction account daily to ensure funds are available. If funds are not available, we have a line of credit with our Corporate Credit Union for $5 that would be utilized to cover debit settlements. If this should occur, we have a LOC available with our Corporate Credit Union. If this should occur, we have a LOC available with our Corporate Credit Union. Conclusion Low 24 oderate 48 igh 72 NorthPark has a Risk Rating for AC of _30_. The risk is moderate for Credit, Operational, Fraud and Systemic Risk due to the Automated Clearing ouse (AC) activity conducted by NorthPark. Page 6