Compliance and Payments: A View of the Legal Framework Lori Moore, CRCM ATTUS Technologies, Inc. Key Learning Points Identify existing rules and regulations applicable to various payment methods Understanding critical aspects of key rules and regulations Managing risk through disclosures and contracts Recent and/or upcoming changes to the legal framework Disclaimer This presentation and applicable materials are intended for general education purposes and nothing in this presentation should be considered to be legal, accounting or tax advice. You should contact your own attorney, accountant or tax professional with any specific questions you might have related to this presentation that are of a legal, accounting or tax nature. 1
Understanding Legal and Regulatory Requirements Minimizes Risk Compliance Cross Channel Fraud Minimizes Losses Financial Institution Liability Customers Retention Minimizes Audit and Exam Findings Legal Framework by Payment System Checks and Legal Equivalence Uniform Commercial Code Article 3 governing Checks Uniform Commercial Code Article 4 governing Check Collection Regulation CC Funds Availability Regulation J establishes procedures for the interbank system of collecting Checks Check 21 governs Substitute Checks / Image Replacement Documents (IRDs) Legal Framework by Payment System Checks and Legal Equivalence (cont d) Federal Reserve Bank Operating Circulars governs clearing and settlements for checks cleared through the Federal Reserve System ECCHO Rules governs image rules for exchanges between ECCHO members NACHA Operating Rules governs ACH check conversion entries (ARC; BOC; POP; and RCK) 2
Legal Framework by Payment System Fedwire Funds Federal Reserve Act Sections 11 & 13 Uniform Commercial Code (UCC) Article 4A Regulation J, subpart B FRB Operating Circulars 1, 5, and 6 Regulation CC Bank Secrecy Act 31 CFR Title X (Recordkeeping Requirements / Travel Rule) OFAC -- Office of Foreign Assets Control Regulations Legal Framework by Payment System Cards Network Rules Regulation E (consumer only) Automated Clearing House (ACH) NACHA Rules (Network Rules) Regulation E Uniform Commercial Code 4A OFAC Disclosures and Contracts Regulatory provisions can also be carried out through disclosure or contract. In the absence of legal and regulatory requirements, contracts are necessary to manage risk. Usually applies to new payment systems such as RDC, mobile banking 3
Disclosures and Contracts Disclosures use of model verbiage typically provides safe harbor Variations of verbiage may increase risk of non-compliance to the regulation Contracts (Agreements) Require both parties to agree to the terms Regulation CC Subpart Regulation B: Expedited E Funds Availability Subpart C: Collection of Checks Regulation CC Subpart B: Implements the Expedited Funds Availability Act (EFAA) Subpart C: Covers check collection and returns Includes RCK Represented Checks (ACH Application) 4
Regulation CC Subpart B Categorizes and defines normal funds availability to applicable deposits by type Provides rules on exceptions holds Provides maximum hold periods for each type of deposit used Rules on payment of interest *Since NACHA Operating Rules provide for better funds availability than provided for in Reg CC, NACHA Operating Rules prevail. Regulation CC - Changes July 21, 2011 Dodd-Frank Section 1086(e) increases first $100 rule to $200 Amount will increase every 5 years based on annual CPI in increments of $25.00 Still applies to deposits not subject to next-day availability, new accounts, and large item exception. The large deposit exception amount of $5,000 will also be increased every 5 years. Regulation CC - Changes New disclosure verbiage under consideration Requires change in term notice to customers no later than 30 days after Proposed removing references to any specific amount to facilitate future changes. Changes to Exception Hold notice are also proposed. 5
Regulation CC - Changes Proposal indicates incentives for banks to send and receive return items electronically and promotes same-day settlement. The forward and return process would have to meet tthe 4:00 400pm deadline dli on the 2nd dbusiness day following the banking day it was presented. The four day test will be eliminated. Regulation CC - Changes A depositary bank s right to expeditious return would be dependent upon it agreeing to receive return items electronically. The notice of nonpayment for items $2,500 and greater may also be eliminated to provide even stronger incentive. Regulation E Regulation CC: Subpart D - Substitute Check 6
Substitute Check Warranties A bank that transfers, presents, or returns a substitute check warrants: It meets the requirements for legal equivalence A check will not be paid twice Substitute Checks: Indemnity Recipient and subsequent recipients are indemnified for any loss incurred as a result of receiving a substitute check instead of the original check. The amount of the indemnity is determined by the circumstances that resulted in the loss. Substitute Checks: Indemnity Comparative Negligence If a loss results in whole or in part from the indemnified person s negligence or failure to act in good faith, then the indemnity amount shall be reduced in proportion to the amount of negligence or bad faith attributable to the indemnified person. Investigate! Do not just assume the entire loss. 7
Substitute Checks: Error Resolution Recredit claims (submitted in good faith) The consumer s account was charged for a substitute check that was provided to the consumer - The consumer need not be in possession of that substitute check at the time he or she submits a claim. The substitute check was not properly charged to the consumer account or The consumer has a warranty claim with respect to the substitute check Substitute Checks: Error Resolution Recredit claims (asserted in good faith) The consumer suffered a resulting loss Production of the original check or a sufficient copy is necessary to determine whether or not the substitute check in fact was improperly charged or whether the consumer s warranty claim is valid. Substitute Checks: Error Resolution - Timeframes Unlike Regulation E, recredit for substitute checks is subject to availability requirements under Reg CC Subpart D See section 229.54 for detailed recredit requirements See section 229.56 pertaining to liability. 8
Electronic Regulation Funds ETransfer Act Applicable: Check conversion, ACH, Access Device *Mobile Banking, *RDC Regulation E Implements the Electronic Fund Transfer Act (EFTA) Establishes basic rights, liabilities, and responsibilities of consumers who use electronic funds transfer (EFT) services and financial institutions that offer these services. Regulation E Types of EFT transactions covered (but not limited to): Point-of-Sales transfers Automated teller machine transfers Direct deposits or withdrawals of funds Transfers initiated by telephone Debit card transactions, whether or not initiated through an electronic terminal Automated Clearing House (ACH) transactions 9
Regulation E Types of EFT transactions Covered (but not limited to): Check, draft, or similar paper instrument used as a source of information to initiate a one-time electronic fund transfer from a Consumer s Account (ARC, POP, BOC). Regulation E Requirements Disclosures required under Reg E must be clear and readily understandable, in writing and in a form the consumer may keep. Electronic delivery of disclosures/statements OK if consented to pursuant to E-Sign Act. Note: Providing the error resolution disclosure [protection] on a non-consumer account can unnecessarily bind you to the rules! Regulation E Requirements Four specific disclosures required: 1. Initial disclosure specific verbiage required. (Refer to section 205.) 2. Error resolution notice Full disclosure or modified version 3. Disclosures at ATMs regarding fees imposed 4. Notice of change in any terms 21 days in advance of a change causing an adverse effect 10
Disclosure Requirements Disclosures must also be provided if a consumer contracts for a new EFT service and the terms and conditions differ from those originally disclosed. Example Mobile Banking Remote Deposit Capture Disclosure must be given in close proximity to the event requiring disclosure. Regulation E: Error Resolution What is an error? An unauthorized EFT An incorrect EFT to or from the customer's account The omission of an EFT from a periodic statement A computational error made by the institution relating to an EFT The customer's receipt of an incorrect amount of money from an electronic terminal An EFT not identified in accordance with requirements related to receipts, periodic statements, and preauthorized transfers. Error Resolution: Excluded Claims EFTs that are AUTHORIZED by the accountholder but are later disputed for various reasons. This may be disputed in accordance with the card network rules (i.e. Visa, MC), they are not errors subject to Reg E. 11
Consumer Liability Section 205.6 of Regulation E sets forth three tiers of liability for unauthorized transfers. Tier 1 - $50.00 Tier 2 - $500.00 Tier 3 - Unlimited Depending on the facts of the claim, the customer's liability may be a maximum of one or a combination of all three tiers. Tier 1: Liability Not to Exceed $50 A customer must notify the financial institution within two business days after learning of the loss or theft of an access device to limit their liability for unauthorized transfers to the lesser of $50.00 or the amount of the transfers that occur before notice is given. Tier 2: Liability Not to Exceed $500 If the institution is not notified within the 2-business day timeframe, the customer's liability is limited to the lesser of $500 or: The lesser of $50 or the amount of transfers occurring within the two-business-day period; plus The amount of transfers occurring after the two-business-day period and before notice is given. This is provided the institution can prove the transfers could have been prevented with timely notification. 12
Tier 3: Consumer Liability If an unauthorized transfer appears on a periodic statement, the customer must notify the financial institution within 60 calendar days after it is sent to avoid liability for any unauthorized transfers occurring after that time. If timely notice is not given, the customer is liable for any transfer posted to their account on Day 61 forward as long as the financial institution can establish the transactions could have been prevented. Tier 3: Consumer Liability As illustrated here, the institution is liable from the date of the first unauthorized transfer and for the 60 days following the close of the statement on which it appeared; the customer is liable for those in the 60 days following. 60 Day Period Ends Notice Given Period of Liability Stmt 1 st trans + 30 days + 30 days + 30 days + 30 days Financial Institution Liability Customer Liability Regulation E Uniform Commercial Code 3 & 4 13
UCC 3 & 4 A negotiable instrument is defined as an unconditional promise or order to pay a fixed amount of money, with or without interest or other charges described in the promise or order. UCC 3 & 4 Warranties There are three sets of UCC warranties that are of particular importance in the area of problem checks. Transfer Warranties ( 4-207) Presentment Warranties ( 4-208) and Encoding Warranties ( 4-209). UCC 3 & 4 Transfer Warranties There are five separate transfer warranties made to the transferee and to any subsequent collecting bank. The customer or collecting bank that transfers an item and receives a settlement or other consideration warrants that 14
UCC 3 & 4 Transfer Warranties The warrantor is entitled to enforce the item (e.g. no forged or missing endorsements.) All signatures on the item are authentic and authorized. The item has not been altered. The item is not subject to a defense or claim in recoupment of any party that can be asserted against the warrantor; and The warrantor has no knowledge of any insolvency proceeding commenced with respect to the maker or acceptor or, in the case of unaccepted draft, the drawer UCC 3 & 4 Presentment Warranties If an unaccepted draft is presented for payment or acceptance and the drawee pays or accepts the draft, the person obtaining payment or acceptance, at the time of presentment, and a previous transferor of the draft, at the time of transfer, make the following warranties to the drawee that pays or accepts the draft in good faith: UCC 3 & 4 Presentment Warranties They were entitled to enforce the draft or authorized to obtain payment or acceptance of on behalf of a person entitled to enforce the draft. [e.g. there are no forged or missing endorsements.] The draft has not been altered; and The warrantor has no knowledge that the signature of the purported drawer is unauthorized. 15
UCC 3 & 4 Presentment Warranties The warrantor can raise several defenses, including: The endorsement is effective due to fictitious payee or impostor; The responsible employee defense; The drawer's negligence precludes the loss from being asserted; Drawer failure to examine and report. UCC 3 & 4 Encoding Warranties This warranty is set under the revised UCC Section 4-209 as follows: A person who encodes information on or with respect to an item after issue warrants to any subsequent collecting bank and to the payor bank or other payor that the information is correctly encoded UCC 3 & 4 Signatures A person is not liable on an instrument unless: The person signed the instrument, or The person is represented by an agent or representative who signed the instrument and the signature is binding on the representing person (Drafts) 16
UCC 3 & 4 Signatures If more than one signature is required to constitute the authorized signature of an organization, the signature of the organization is unauthorized if one of the required signatures is lacking. Unauthorized signatures must be reported no later than 12 months after receiving the item or statement. UCC 3 & 4 Indorsements Any person taking or paying an instrument fails to exercise ordinary care with respect to the endorsement may be liable if the failure contributed to the loss. Employers may be responsible for fraudulent endorsement by an employee. Negligence by an employer may also negate liability. UCC 3 & 4 Negligence Careless Office Procedures Failing to separate check-writing and statement review functions Sending a check to a person with the same name as the payee Failing to adopt or follow audit procedures Careless handling of facsimile signature devices Knowingly hiring an untrustworthy bookkeeper 17
UCC 3 & 4 Alterations "Alteration" is defined as An unauthorized change in an instrument that purports to modify in any respect the obligation of a party or An unauthorized addition of words or numbers or other change to an incomplete instrument relating to the obligation of a party. An alteration does not discharge any party from the original obligation. UCC 3 & 4 Alterations Before agreeing to accept a loss in connection with an alteration, the drawee bank should first examine all available defenses to negate liability. This includes Alterations Liability Not a material alteration Change was authorized Customer negligence Unauthorized completion Unauthorized completion Failure to examine and report 18
Regulation E Uniform Commercial Code 4A UCC 4A UCC4A is a state law that governs wholesale EFT (typically corporate transfers) Wire transfers (predominately) ACH Applies to Corporate credits (CTX and CCD) Specifically excludes following items: EFT Items that are covered by Reg E (consumer items) (4A-108) Debit transfers (consumer and corporate) UCC 4A Outlines the rights and liabilities of each of the participants. Some elements can be varied by contract while other elements cannot be varied. 19
Security Procedures Purpose Protect all parties involved Must Detect Fraudulent payment orders Erroneous payment orders Should be Commercially Reasonable Security Procedures Commercially reasonable security procedures have NOT been defined yet: No court cases setting precedent yet But there are accepted industry standards. There have been some recent law suits filed over this issue which could lead to legal precedence. Security Procedures Signature verification (as security procedure) alone is NOT commercially reasonable (4A-201) This would typically come into play for ODFI that originates CCD or CTX credits 20
Security Procedures Must be agreed upon in writing (in absence of contract, FI takes all liability) Consumer wire transfers typically initiated when consumer comes into branch, should have a form which consumer signs which includes contract language. Security Procedures If customer refuses financial institution s normal procedures, alternate is considered to be commercially reasonable if agreed to in writing. Specifically outlined in UCC4A (4A202c) Example Customer doesn t want to use dual control and opts for single control. If this has been agreed to in writing, and a fraudulent payment order is acted upon by the financial institution; the customer would be liable to pay financial institution for transfer. Questions? Contact Us: 1 888 494 8449 www.attustech.com Products Lee Thomas ext 17233 lthomas@attustech.com Services Geoffrey McNeill ext 17230 gmcneill@attustech.com 21
Example Claims Governed by Reg Regulation CC E Substitute Checks: Indemnity A loss resulting from a breach of a substitute check warranty The indemnity is equal to the amount of any loss proximately caused by the warranty breach. This may include interest, costs, reasonable attorney s fees, and other expenses of representation Substitute Checks: Indemnity A loss that did not result from a breach of a substitute check warranty, the indemnity amount shall be the sum of The indemnity is equal to the amount of the loss, up to the amount of the substitute check; and Interest and expenses (including costs and reasonable attorney s fees and other expenses of representation) related to the substitute check. 22
Regulation Example EClaims Governed by Reg E Regulation E Applies to Consumer Accounts that receive authorized EFT transactions (debit or credit) Electronic Fund Transfer (EFT) Definition Any transfer of funds that is initiated through an electronic terminal, telephone, computer, or magnetic tape, for the purpose of ordering, instructing, or authorizing a FI to debit or credit a Consumer s Account Exemptions to Regulation E Checks, check guarantee or authorization services. Wire or other similar transfer. Purchase or sale of securities or commodities. Automatic transfer under agreement between a consumer and financial institution which provides that the institution will initiate individual transfers with a specific request from the consumer, including interest and loan payments, etc. Preauthorized debits or credits to small financial institutions. (Asset size $100 million or less.) Telephone-initiated transfers between a consumer and a financial institution that do not take place under a telephone bill payment or other prearranged plan or agreement contemplating periodic or recurring transfers. RCK Entries (Note: Reg E does apply to any fee authorized by the consumer to be debited electronically from the Consumer s Account because the Check was returned for insufficient funds.) 23
Modified Periodic Statement Error Resolution Disclosure In case of errors or questions about your electronic transfers, if you think your statement or receipt is wrong, or you need more information about a transfer on a statement or receipt, telephone us at [insert telephone number] or write us at [insert address] as soon as possible. We must hear from you no later than 60 days after we sent you the FIRST statement on which the error or problem appeared. 1. Tell us your name and account number (if any). 2. Describe the error or the transfer you are unsure about, and provide detail about the error or why you need more information. 3. Tell us the dollar amount of the suspected error. We will investigate your complaint and will correct any errors promptly. If we take more than 10 business days to do this, we will credit your account for the amount you think is in error, so you will have the use of the money during the time it takes us to complete our investigation. Reg Example E Claims Governed by Reg Example E Claims Consumer Liability Customer notifies bank on Tuesday, August 4, that her ATM card is missing and four unauthorized debits totaling $650 have posted to her account as follows: Monday 7/20 - $150 ATM w/d Friday 7/24 - $200 ATM w/d Monday 7/27 - $120 ATM w/d Friday 7/31 - $180 ATM w/d Depending on the facts of the claim, the customer's liability may be a maximum of one or a combination of all three tiers. 24
Example 1: Claim involving an Access Device Timely Notice If she realized her card was missing on August 3 and notified the bank on August 4, her liability is limited to $50. What if she notifies the bank on August 4 but states she had realized her card was missing on Wednesday, July 22? Example 2: Claim Involving an Access Device Timely Notice Not Given After learning her card was missing on Wednesday, July 22, she must notify the institution no later than Friday July 24. Beginning on July 25 through the day she notified the bank, her liability increased to a maximum of $500. In this case, her liability is as follows 25
Multiple Tiers Customer receives notice account is overdrawn on October 12. Upon reviewing his account activity online, he discovers the following transactions: TRANSACTION DATE AMOUNT June 1 st $100 July 1 st $80 August 1st $120 September 1st $120 October 1st $100 Total $520 Multiple Tier Liability Although notification was timely with respect to when he learned his ATM card was missing, it was not given in time to avoid liability for transfers posted after the close of the 60 day period. Notice was required no later than August 29th. Therefore, the customer s liability was $270, which is calculated as follows: June 1 st July 1 st Transaction Date Amount Liability ATM W/D $100 ATM W/D $80 August 15 th ATM W/D $120 Sub Total $300 $50 max September 1 st ATM W/D $120 October 1 st ATM W/D $100 Sub Total $220 $220 (unlimited) Total Customer Liability $270.00 26
Example Claims Governed by Reg Reg CC: Substitute Checks E Error Resolution Timeframes Substitute Checks: Error Resolution Claims must be submitted by the end of the 40th calendar day after the later of the calendar day on which the bank mailed or delivered, by a means agreed to by the consumer The periodic account statement that contains information concerning the transaction giving rise to the claim; or The substitute check giving rise to the claim. Substitute Checks: Error Resolution Claims submitted orally within the time period required are considered timely. The bank may request that the claim be submitted in writing within 10 business days. 27
Substitute Checks: Error Resolution - Timeframes Valid Claims Recredit is required no later than the end of the business day the claim was found to be valid but no later than the 10 th business day after receiving the claim. Total recredit should include the amount of the substitute check plus any interest and/or fees. Substitute Checks: Error Resolution - Timeframes Pending Claims Provisional recredit is required no later than the 10 th business day after receiving the claim. Total recredit must be the lesser of the amount of the substitute check (customer s loss) or $2,500, plus interest on that amount if the account is an interestbearing account. Substitute Checks: Error Resolution - Timeframes Invalid Claims - Provisional recredit may be reversed if a pending claim is found to be invalid. Investigation must be completed no later Investigation must be completed no later than the 45 th calendar day after the day the claim was received. 28
Substitute Checks: Error Resolution - Timeframes Customer must be notified of Recredit or provisional recredit if 10-day timeframe is not met. Final recredit if claim is found to be valid or Provisional recredit reversal if found to be invalid UCC Example Claims Governed by Reg Key E Definitions UCC 3 & 4 Signatures A signature may be made: manually or by means of a device or machine, and by the use of any name, including a trade or assumed name, or by a word, mark, or symbol executed or adopted by a person with present intention to authenticate a writing. 29
UCC 4A Key Definitions & Points Payment Order a set of instructions that outlines how a payment should be made (who, what, how much, when, etc) Can be transmitted in writing, orally, or electronically Does not state a condition of payment to beneficiary other than time Can be a single payment (wire transfer) or multiple payments (ACH file) Beneficiary person to be paid by beneficiary s financial institution (can be person, company or other entity) Beneficiary s financial institution financial institution identified as having account for beneficiary UCC 4A Key Definitions & Points Funds Transfer Day the financial institution s operating hours for processing transfers (i.e. deadlines) Sender party sending the payment order to FI Security Procedures methods or processes employed by parties to: Verify authenticity of parties (fraudulent payment orders) Detect errors (erroneous payment orders) UCC 4A Key Definitions & Points ODFI* Acceptance When the Financial Institution (ODFI or sending financial institution) becomes legally obligated to execute the payment order. FI has no legal duty to accept payment order. Best practice is to define acceptance after all required processing steps have been completed. Credit review/checking Security process OFAC and similar screening *ODFI Originating Depository Financial Institution 30
UCC 4A Key Definitions & Points RDFI Acceptance When the RDFI becomes legally obligated to pay the amount to the receiver on settlement date. RDFI accepts entry at the earliest time it: Makes funds available to receiver Notifies receiver of receipt or that account has been credited Receives final settlement for the entry If RDFI receives entry and takes no action to return within time frames will be deemed to have accepted entry UCC 4A Key Definitions & Points UCC4A allows Financial Institutions to set their Funds Transfer Day (4A-105) Essentially this allows Financial Institutions to establish their own operating hours for processing funds transfer This may or may not coincide with the Federal Reserve s published Fedwire or ACH operating hours ACH Rules define when credits must be made available for beneficiary (receiver) to withdraw If payment order is received after the financial institution s cutoff, financial institution may hold until the next funds transfer day to execute (pay the beneficiary). Wire Example Transfer Claims & ACHGoverned by Reg Key E Points 31
Wire Transfer Key Points Need for Written Agreement Absence of contract puts liability risk on financial institution Notice for Credits of Incoming Transfer Definition of Acceptance (4A-209) Need for Commercially Reasonable Security Measures Signature verification alone is NOT (4A-201) Wire Transfer Key Points Financial institution can rely on Account number alone to post incoming transfer (4A-207) Unless it determines that there is a discrepancy between een name & acct number If name & acct number mismatch is known, there can be no acceptance of payment order ACH Rules explicitly state same reliance on account number (Article 4.1.4 OR23) * ACH Key Points Since UCC4A defers to the NACHA Rules, the following UCC4A points are not covered for ACH items: Notice of incoming credits (4A-404) Typically this is varied by contract (depositor s s agreement) ACH payments are provisional since funds must be made available prior to final settlement, payments can be reversed if sender (originator) would fail. This is also typically varied for corporate entries by contract (depositor s agreement) ACH Rules specify consumer funds availability 32
Comparison of Terms (ACH Credit) UCC Article 4 A Acceptance (Section 4A-209) Beneficiary (Section 4A -104(f) ) Beneficiary Bank (Section 4A -103(g) ) Execute (Section 4A-301) Originator (Section 4A-104 (b)) Originator 's Bank (Section 4A-104 (c) ) Payment Date (Section 4A-401) Payment Order/Funds Transfer (Section 4A-103 (a), 4A-104 (a)) Receiving Bank (Section 4A-103 (e) ) Rejection (Section 4A-210) Sender (Customer) (Section 4A-103 (d), 4A-105 (a) (d)) NACHA Operating Rules No Counterpart Receiver RDFI (or ODFI in an on-us entry) Transmit to an ACH Operator Originator ODFI Settlement Date Credit Entry ODFI, FRB as Operator, or RDFI Return of Entry by RDFI ODFI, FRB as Operator, or RDFI Questions? Lori Moore, CRCM ATTUS Technologies, Inc Lori Moore, CRCM serves as the Director of Compliance for ATTUS Technologies, Inc. Lori has 27 years of experience in the banking industry, previously serving as IT coordinator, VP of internal audit, VP of risk management, VP of operations, BSA officer and compliance officer for both small and large community banks. Lori has extensive training in bank operations, audit, risk management and compliance. She received the Outstanding Graduate designation from Texas Bankers Association (TBA) Operations School and served as an honorary member of the TBA Operations Committee 33