Andy Barlow, AAP, NCP Executive Vice President WACHA. Jen Wasmund, AAP, CTP, NCP Vice President of Education & Compliance UMACHA

Transcription

1 Andy Barlow, AAP, NCP Executive Vice President WACHA Jen Wasmund, AAP, CTP, NCP Vice President of Education & Compliance UMACHA

2 Disclaimer Regional Payments Associations, through their Direct Membership in NACHA, are specially recognized and licensed providers of ACH education, publications and support. Regional Payments Associations are directly engaged in the NACHA rulemaking process and Accredited ACH Professional (AAP) program. NACHA owns the copyright for the NACHA Operating Rules & Guidelines. The Accredited ACH Professional (AAP) is a service mark of NACHA. This presentation and applicable materials are intended for general education purposes and nothing in this presentation should be considered to be legal, accounting or tax advice. You should contact your own attorney, accountant or tax professional with any specific questions you might have related to this presentation that are of a legal, accounting or tax nature. 2

3 Agenda ACH Risk Management in General What do we have to do? How do we get there? Real-life scenarios Wrap-up Questions 3

4 General Overview 4

5 What Do We Have to Do? Determine your organization s risk tolerance and appetite Objectives Business Strategy Risk Parameters Board of Directors Management Board of Directors Results reported by Management Board of Directors Management Develop effective internal controls Periodic reporting 5

6 How Do We Get There? Know what your organization s pain points are Financial loss or fines Exam exceptions Reputation damage How likely is it you will incur this damage Evaluate the risk vs. reward payoff and how bad could it be? Build an ongoing management program to close gaps where the risk is too great for your FI s appetite 6

7 How Do We Get There? ACH Policy Approved by the Board of Directors Framework of overall program Procedures Daily operational guides Ensures employees are consistently operating within risk tolerances Reporting Results requested by Board of Directors Anomalies, exceptions Any losses 7

8 Where does your organization fall? REWARD RISK 8

9 How Each Organization Creates a Different Approach 9

10 Real-Life Scenarios Same Day ACH I want it now! Third-Party Senders Risk Assessments Dirty Deeds Educating Originators Exposure Limits Know When to Hold Them Should they stay or should they go? We Don t Need No Education?! 10

11 Same Day ACH I want it now! To offer Same Day ACH or not that is the question What are you going to consider? 11

12 Same Day ACH: Risks and Controls Credit risk Unbalanced files Operational risk Effective Entry Date Faster or new processing windows Strategic risk Reputational risk Manual review Case-by-case, limited use Software or system controls Timing of release to ACH Operator 12

13 Risk Assessments Dirty Deeds The Rules are not prescriptive Without feedback from your primary regulator, what s good enough for you and your financial institution? How does the ACH Risk Assessment interact with other payments systems or products? 13

14 Risk Assessments: Risks and Controls Compliance/Legal risk Failure to stay current with regulatory changes Operational risk No review of processes to ensure accuracy Verifying staff are aware of current procedures Complete the risk assessment Ensure other audits and compliance obligations are also met Proper tracking of feedback from regulatory exams 14

15 Exposure Limits know when to hold them. How do you approach setting exposure limits? Who, what, where, when and how? 15

16 Exposure Limits: Risks and Controls Credit risk Too high Insufficient due diligence Not reviewed frequently enough to detect change in condition Fraud risk More risk of Corporate Account Takeover? Operational risk Entered accurately for monitoring Appropriate policies ACH and/or credit Procedures Schedules and consistent documentation 16

17 Third-Party Senders should they stay or should they go? All or nothing? What about if you find out an existing Originator is also acting as a Third-Party Sender? What else do I have to do under the Rules for Third-Party Sender Registration next year? 17

18 Third-Party Senders: Risks and Controls Compliance/Legal risk Know Your Customer s Customers (KYCC) Credit risk Reputational risk Strategic risk Onboarding and due diligence procedures Credit review and Standard Entry Class (SEC) code usage Strong agreements Debits vs. credits 18

19 Educating Originators We don t need no education?! What is sufficient? How much information do you need to share with your Originators to keep them in compliance with the Rules? 19

20 Educating Originators: Risks and Controls Compliance/Legal risk Non-compliance with Rules or regulations Fraud risk Operational risk Standard training at onboarding Plan for ongoing training Monitoring for exceptions or those in need of extra help 20

21 21

22 Where does your organization fall? REWARD RISK 22

23 Thank you! 23

24 Resources PAR/WACHA- The Premier Payments Resource HELP DESK Phone: Toll Free: Fax: