ACH Risk: Is It a Myth or Reality. Mary Gilmeister, AAP, NCP President WACHA Fred Laing, II, AAP, CCM, NCP President UMACHA

Transcription

1 ACH Risk: Is It a Myth or Reality Mary Gilmeister, AAP, NCP President WACHA Fred Laing, II, AAP, CCM, NCP President UMACHA

2 Disclaimer WACHA and UMACHA, through their Direct Membership in NACHA, are specially recognized and licensed providers of ACH education, publications and support. Regional Payments Associations are directly engaged in the NACHA rulemaking process and Accredited ACH Professional (AAP) program. NACHA owns the copyright for the NACHA Operating Rules & Guidelines. The Accredited ACH Professional (AAP) is a service mark of NACHA. This material is derived from collaborative work product developed by NACHA The Electronic Payments Association and its member Regional Payments Associations, and is not intended to provide any warranties or legal advice, and is intended for educational purposes only. This material is not intended to provide any warranties or legal advice, and is intended for educational purposes only. This document could include technical inaccuracies or typographical errors and individual users are responsible for verifying any information contained herein. No part of this material may be used without the prior written permission of WACHA/PAR 2015 PAR/WACHA & UMACHA, All rights reserved

3 Agenda Introduction Types of Risk Risk Management approaches for each type High level approaches to protect your institution

4 Is ACH Risky?? Midway Airlines FAILS! ICN, a long distance carrier declares Chapter 7 two days after a debit file is generated A hacker, working through a third party, set s up a church account that s bogus and steals over $100,000 A banks customer sends a file for $456,000, it turns out the item was NOT generated by the customer but by a hacker

5 Types of Risk (FFIEC based) Credit Operational Fraud Systemic Reputational Third-Party

6 What is ACH Credit Risk? The risk that a party to a transaction will be unable to provide the necessary funds for settlement to occur Losses due to Credit Risk typically result from the failure or bankruptcy of a company ODFIs are responsible for controlling credit risk Develop and implement credit monitoring and control procedures 6

7 ACH Credit Risk ODFI exposure (for credit entries) Period of time between the initiation of ACH credit file until the company funds the account Amount of risk based on total amount of the file Up to 2 days 7

8 Credit Risk ACH Debits ODFI Exposure Date funds available to originator until debits can no longer be returned by RDFIs 2 Banking days (24 hrs) Up to 60 days from settlement Unauthorized could be returned as ODFI warrants authorization Amount of risk based on amount of returned ACH debit NOTE: Statute of Limitations 7 years for most states where the ODFI would still be liable 8

9 ODFI Credit Monitoring and Control Techniques STEP 1 - Educate financial institution personnel STEP 2 Due diligence including using existing credit ratings STEP 3 - Establish exposure limits Maximum dollars per file/batch Maximum per entry (corporate entries) Maximum exposure across product lines Return percentages STEP 4 - Establish procedures for over limit transactions (escalation) STEP 5 - Provide ongoing maintenance (periodic review)

10 What is Operational Risk? In the ACH payment system, operating risk is the risk that the exchange of ACH transactions will not be completed accurately or on time because of an operational failure at some point in the exchange process 10 PC Failure Disasters Power Outages

11 Operational Failure An operational failure is any disruption in normal processing including: Failure/Unavailability of Computer Hardware or Software, Disruptions in telecommunications equipment and/or Advertent loss, alteration, or duplication of ACH data 11

12 Examples of Operating Risk Hardware, software, telecommunications and power failure Human error late returns timeliness of reconciliation aged items out of balance conditions Staffing problems lack of training sick or vacationing staff 12

13 Operational Risk Controls Reliable equipment, regular maintenance, adequate backup Detection and correction of bugs in software Diagnostic tools, backup modes of transmissions UPS systems, backup procedures in event of power failure Good supervision, cross-training, audits Disaster recovery plans Corruption of ACH Data File Accountability and Balancing Secure Storage Limited Access Backup Copies Audit Trails 13

14 What is Fraud Risk? The risk that ACH data will be compromised through: introduction of false transactions alteration of valid transactions alteration of data that controls the routing or settlement of valid ACH transactions 14

15 Causes of Fraud Risk Fraudulent activities are usually the work of: disgruntled or dishonest employees outside parties (such as intruders or interlopers) combination of both where two or more individuals are acting in collusion Fraud can also be committed by an organization 15

16 Tools to Combat Fraud Risk Sound personnel practices Good physical security for computer, communications and ACH Operations areas Effective data security Rigorous control of all changes Operational controls as used to reduce Operational risk 16

17 What is Reputational Risk? Risk that actions or events that take place involving your institution will affect your reputation. 17

18 Third Party Senders are a subset of Third Party Service Providers Third Party Service Provider does NOT always act as a Third Party Sender A Third Party Sender is considered to be a Third Service Provider No contractual agreement between the ODFI and the Originator Third Party Service Providers Third Party Sender Sending Point Receiving Point 18

19 Third Party Sender ODFI ABC Company Hardware Store Payroll Company No agreements with originators Grocery Bike shop Church Dry Cleaner Day Care 19

20 Third Party Service Provider Grocery Bike shop ODFI Co/ODFI Agreements Payroll Company Church Dry Cleaner Day Care 20

21 What is Systemic Risk? The risk that the inability or unwillingness of one participant in a clearing and settlement network to settle its commitments will cause other network participants to be unable to settle their commitments Such a chain of events could undermine confidence in the nation s payments system and therefore systemic risk of serious concern 21

22 Higher Level Approaches to Managing Risk

23 ACH Origination Policy Why do we need policies?..controls needed for an effective ACH risk management program include written policies... loan policies should include formal underwriting standards and an approval policy for ACH originators. 23

24 With that Said. The FFIEC Guidance Says to (Federal Financial Institution Examination Council - OCC, FDIC, OTS, NCUA & State Liaison Committee) Mitigate Fraud Risk through proper due diligence for all originators and strict adherence to ACH and credit policies Manage Credit Risk by establishing policies, procedures and limits that acknowledge the risks originators bring to an ACH operation Clear policies and procedures need to establish the proper control of these highly automated activities to manage the Operational Risk 24

25 ACH Origination Policy Goals & Objectives in compliance with the Rules Risk Management considerations Products offered Prohibited Originators Third Party Senders Agreements Outlines steps taken to risk rate all originators and develop exposure limits to cover per file and multi-day exposure Monitoring Exposure Limits/Over Limit Files 25

26 ACH Origination Policy, (Cont.) Timely review of Originators & Exposure Limits Return Monitoring Third Party Service Providers Direct Access Considerations File Delivery Data Breach OFAC & US Patriot Act UCC4A/Security Measures Contingency Plan ACH Audit & Risk Assessments 26

27 OFAC Policy Guidelines for compliance with the requirements of OFAC. Prohibited parties Prohibited transactions Training of employees in regards to OFAC compliance 27

28 Agreements Originator/ODFI Agreement Third-Party Sender Agreement Third-Party Processor Agreement Agreement with the ACH Operator 28

29 Originator/ODFI Agreements Defines parameters of relationship between parties Transmittal of Entries and Security Procedures Company Representations, Warranties & Agreements Financial Institution Obligations Company s account Exposure Limits Due Diligence Cancellation, Amendment of Entries Rejection of Entries Provisional Credit Notice Reversals 29

30 Originator/ODFI Agreements (Cont.) Notice of Returned Entries & Notification of Change Entries Returned as Unauthorized Unauthorized Return Rate in Excess of 1% Periodic Statements Fees Liability Rules Enforcement Inconsistency of Name and Account Number Rules Compliance Review-Right to Audit The right of the ODFI to terminate or suspend the Originator The ability to audit the originator Any restrictions on the types of transactions allowed 30

31 National ACH Rules Enforcement System If the Rules have been violated (allegedly) Report of possible Rules Violation filed with NACHA Follow up is done within specific timeframes Depending on that follow-up the violation may go to the Enforcement Panel for review and possible fine Class 1 recurrence Class 2 Eight reasons Class 3 Rules violation continues 31

32 National System of Fines Types of Violations Returns 5.13% Authorization 8.07% ARC 1.04% RCK 0.29% Prenotes 0.17% Reversals 0.12% POP 0.06% ODFI Reporting 0.06% Invalid Accounts 8.82% NOCs 76.24% 32

33 ODFI Audit Requirements Delivery of NOC information within 2 days Request for authorization Permissible Return entry acceptance Compliance with UCC 4A (Disclosures/agreements) Verify identity of originators that use an unsecured electronic network Reversing files and entries follow the rules BOC entry compliance ODFI reporting to NACHA when requested Direct Access registration 33

34 ODFI Audit Requirements Ensure originators are informed and in compliance with: How do you keep educated on proper processing and Rule changes? Originator Audits Third Party Audit requirements Authorization requirements Pre-note requirements Usage of correct SEC codes Usage of correct company name Requirements for POP entries Proper Authorization/Notice/Receipt Requirements for TEL entries Proper Authorization/Verification of identity/verification of Routing number Single vs Recurring Notices 34

35 ODFI Audit Requirements Requirements for ARC entries Notice/storage Requirements for RCK entries Requirements for WEB entries Originators have fraudulent transaction detection systems in place Originators verify the identity of each receiver Evidence of assent (electronic signature) Each Routing and Transit number has been verified Originators will conduct an annual security audit 35

36 ACH Risk Assessment The Rules requires all participating DFI s to conduct a risk assessment of their ACH activities, and to implement risk management programs based on the results of such assessments, in accordance with the requirements of their regulator(s) 36

37 ACH Risk Assessment 1) Assess the nature of risk associated with ACH activity; 2) Perform appropriate know-yourcustomer due diligence; 3) Establish controls for Originators, thirdparties, and direct access to ACH Operator relationships 4) Have adequate management, information and reporting systems to monitor and mitigate risk 37

38 QUESTIONS Please fill out your Evaluations 38

39 Contact Info: Mary Gilmeister, AAP, NCP President WACHA Fred Laing, II, AAP, CCM, NCP President UMACHA