GFOASC. October 20 th, 2015

Transcription

1 GFOASC October 20 th, 2015

2 State of the state 78 State Agencies 88 Local Governments 26 Colleges & Universities 2

3 State of the state $323,008,782 Total spend volume 2014/2015 rebate period 1,233,977 Total # of transactions 2014/2015 $269 Average transaction size 17,820 Total # of open cards August 12,612 Avg. # of active cards per month Total savings based on industry average purchase order reduction, based on RPMG 2014 study: Industry average savings of $70 per transaction 1,233,977 total transactions x $70.00 = $86,378,390 3

4 State of SC rebate history 2015 Rebate: $5,751,197 Total Rebate 2014 : $4,773, : $4,558, : $4,441, : $3,727, : $3,481, : $3,163, : $3,207,294 4

5 State of SC rebate history Less than $1MM Do Not Qualify Rebate Minimum $1MM- $2.9MM 70 bps $7,000 $3MM- $4.9MM 90 bps $27,000 $5MM-$9.9MM 130 bps $65,000 $10MM- $14.9MM 139 bps $139,000 $15MM-$19.9MM 144 bps $216,000 $20MM - $24.9MM 149 bps $298,000 $25MM - $29.9MM 154 bps $385,000 $30MM+ 159 bps $477,000 5

6 Optimization drives program growth, process savings Traditional purchase order process Purchase Card process Savings $90 Average process cost * $20 $70 process cost $253,526 Average process cost per month ** $47,362 $206,164 process cost per month $3,042,312 Between Annualized process cost # of steps $568,344 Less than 10 $2,473,968 annualized process cost steps 84% of respondents report increased efficiency and reduced costs are important benefit of purchasing card use. 6 *Based on the 2014 Purchasing Card Benchmark Survey results by RPMG Research Corporation ** Rounded transaction count; based on average monthly card spend of $1MM and, per the results, of the 2012 NAPCP poll, average transaction size of $359 (based on 2,786 transactions).

7 Identify opportunities to optimize program Types of data analysis Type of Analysis Program Benefit Resources AP / Supplier match analysis Expand card program based on acceptance BofAML spend analysis (epayables programs only) Commercial Card slippage analysis Declined transaction analysis Identify suppliers paid by multiple forms Evaluate changes to MCC or spend limit blocking Internal A/P analysis: 1. Review vendors payments 2. Identify vendors paid with both check and card 3. Migrate check payments to card BofAML card reporting from Works system Policies and procedures review Streamline processes and improve control BofAML guidance and Visa Best Practice Guides 7

8 Purchasing Card Landscape

9 U.S. Growth Driven by Purchasing Cards Commercial cards are expected to grow $90B over the next 2 years with purchasing cards representing 87% of this jump. Virtual cards are the engine driving the P-card increase. $ Billions Asia Pacific 35% Totals: $234 B $276 B $311 B $350 B $392 B $440 B T&E (5% CAGR ) Source: 2013 US Commercial Card Update Mercator Advisory Group P-Card (16% CAGR ) 80% 60% 40% 20% 0% Percent of organizations using EAP 1 accounts Middle Market Large Market Fortune 500 Government and Not-for-profit All respondents f (1) EAP = Electronic Accounts Payable and represents virtual accounts of all flavors that run on card rails. Source: 2012 RPMG Electronic Accounts Payable Benchmark Survey Results; n=4,375 survey respondents.

10 Why Are Organizations Automating Payments? Organizations can achieve benefits from automating P2P (e.g., improved control, efficiency, and supplier relationships) More control 47% Fraud control Improved cash forecasting Cost savings Early payment discounts Working capital improvement Less days sales outstanding 38% 40% 36% 34% 33% 46% Control Cost Savings Efficiency Supplier Relationship More efficient reconciliation 43% None Straight-through to AP or AR Better supplier / customer relations 35% 35% None 3% 0% 10% 20% 30% 40% 50% For data on this page, at 90% confidence, a variance of 3% is needed to indicate a significant difference Source: 2011 Visa Global Cash Management Survey: Q20. What value do you see a card-based accounts payable automation solution providing? Sample: Mid and large companies Visa Accounts Payable Automation Overview

11 Fraud Awareness, Prevention and Mitigation

12 Fraud Landscape Today Counterfeit fraud represents 70% of card-present fraud and grew 27% in 2014 Total fraud by type Card-present fraud Lost/ stolen 12% Other 5% Card not present 44% Counterfeit 39% Lost/ stolen 21% Other 9% Counterfeit 70% Source: Visa Fraud Reporting System (FRS) and Enterprise Data Warehouse (EDW); CY 2014; U.S. Issued / U.S. Acquired EMV chip will significantly reduce card-present counterfeit fraud Visa Confidential

13 83% of fraud in the US ENCRYPTION REAL-TIME PREDICTIVE ANALYTICS Fighting Fraud With Layers of Security Counterfeit Chip Creates a unique cryptogram for each transaction Not a silver bullet Tokenization Card Not Present Lost and Stolen Tokens replaces account number with unique digital token If payment token is used as the account number, it will be identified as stolen and rejected PIN Fraudster must know PIN for card to work at a point of sale Static data set Source: Visa Fraud Reporting System (FRS) and Enterprise Data Warehouse (EDW); CY 2013; U.S. domestic Visa debit and credit

14 How does EMV chip technology work? Because the cryptogram changes with every transaction, even if the card data is stolen, the information can t be used to create counterfeit cards because the cryptogram would have already expired ^ J O H N D O E ^ ^ ^ ^ Card number Name Expiry Service code CVV (STATIC) ^ J O H N D O E ^ ^ ^ ^ ^ Card number Name Expiry Service code icvv Cryptogram (DYNAMIC) ^ J O H N D O E ^ ^ ^ ^ ^ Card number Name Expiry Service code icvv Cryptogram (DYNAMIC) Visa Confidential

15 U.S. EMV Migration Client readiness report Credit million EMV chip cards issued, 86.1 million of which are credit The U.S. now has more chip cards than any other market in the world U.S. EMV Chip Migration Forecast 1 Credit cards 70% Debit 55.7 million EMV debit cards issued; a 21% increase from July to August 7% of ATMs in the United States are capable of accepting chip transactions Acquirers / Terminals A few hundred EMV terminals are now capable of routing PIN debit EMV transactions using the common debit AID Domestic EMV PV increased 65% from $2.1B in July to $3.4B in August Debit cards 41% Activated terminals 47% Merchants By the End of thousand EMV chip activated merchant locations, a 2% increase from July to August Wave 2 of the merchant EMV survey shows upward trends in all areas. According to the study 95% of merchants are aware of chip technology today Sources: Current cards based on MARS data through August 31, 2015; credit / debit card forecast per Aite Report EMV: Lessons Learned and the U.S. Outlook (June 2014); activated terminal forecast per Payment Security Taskforce Acquirer projections press release (October 2014) ¹Forecast based on information currently available to Visa. Actual results may vary significantly.

16 Data compromises are constantly in the news Sony Pictures 100 terabytes of data Home Depot 56 MM customer records JPMorgan Chase 76 MM account holders ebay 145 MM user records Target 56 MM credit card records (1) Wall Street Journal : White House Cybersecurity Event to Draw Top Tech, Wall Street Execs (Feb. 11, 2015) (2) The Province: Cyber Crime: Fake from the boss is a popular fraud (March 30, 2015) (3) CNN: Insurance giant Anthem hit by massive data breach (Feb. 6, 2015) 4) The Washington Times: Despite evidence, FBI insists North Korea to blame for Sony hacking (Dec. 30, 2014) Source: zations/worlds-biggest-data-breaches-hacks/ 16

17 Industry call to action White House Cybersecurity Event to Draw Top Tech, Wall Street Execs 1 Obama convenes top executives, including Bank of America, to help improve information sharing as breaches get more sophisticated. Our response #1 FRAUD PROTECTION AND IDENTITY SAFETY CARD SOLUTIONS Identify potentially compromised cards Source: Javelin Strategy & Research, 2014 Prioritize and replace compromised cards as needed to reduce payment fraud risk Work closely with impacted clients to streamline the replacement process Replace cards with Chip & PIN enabled cards whenever possible Remain up-to-date with industry trends and best practices as the fraud landscape evolves In advance of the October deadline to issue only Chip & PIN cards, fraudsters are increasing attempts and becoming more aggressive. 1 Wall Street Journal : White House Cybersecurity Event to Draw Top Tech, Wall Street Execs (Feb. 11, 2015) 17 AFP is a registered trademark of the Association for Financial Professionals

18 Client Collaboration Offer accurate contact information for your cardholders including address and phone number(s) Determine the best centralized replacement process for your company s needs Identify established pre-authorized debits to update with new account numbers 1 3 out of companies were a target of cyber attack over the past 18 months companies surveyed in 2015 AFP Risk Survey Managing fraud risk website Bank experts and industry leaders share trends, tools and tactics for all business segments through video vignettes, case studies, podcasts, and featured white papers. Learn more: managing fraud risk website 18

19 Typical data breach and fraud cycle 1 Merchant/agent fails to comply with payment industry security standards. 7 2 Issuer contacts cardholder to investigate suspicious transactions Or, cardholder contacts issuer to report lost or stolen card or a suspicious transaction Issuer conducts a fraud investigation If fraud confirmed, issuer blocks card and lists on network exception file Issuers sends cardholder new card 6 Issuer fraud mitigation activities begin. Fraudulent transactions identified by issuer risk detection systems or by cardholders monitoring their account activity. Network fraud mitigation activities Compromise investigation/forensics Distribution of compromised accounts Development of fraud fighting technologies Dispute resolution and loss recovery processes Execution of fraud and data security compliance programs Hackers search for merchants or agents with weak controls or known security vulnerabilities. Hackers identify target and steal sensitive information Fraudulent transactions conducted at merchant location (retail, CNP, ATMs); criminals often target products that can be quickly converted to cash. Source: Visa Franchise Data Compromise Trends and Cardholder Security Best Practices October 26, 2010 Visa, Inc. Criminal manufactures counterfeit cards for use at retail stores or ATMs; fraudsters may use subsequent phishing attacks to steal information to conduct identity theft or CNP fraud. 4 Breaching the system/network Compromising point of sale (POS) software Tampering with POS devices and ATMs (PIN theft) Skimming

20 Common Causes of a Breach or Compromise There are the three basic types of data security breaches that can lead to a data compromise: Physical breach theft of documents or equipment Electronic breach electronic breach of a system or network environment Skimming capture of card magnetic stripe data using an external device Causes: Not changing the vendor-supplied password upon installation Trivial and common passwords for POS systems Outdated antivirus software definitions Phishing Use of vulnerable or non-compliant software Remote access to systems by third-party providers Not using 2 factor remote access Firewalls not properly configured 20

21 The Costs of a Data Compromise are High Financial impact: You may be subject to significant fines and losses arising from such fraud and from not properly protecting card account information Potential for significant monetary losses related to a data compromise: -Card organization fines and assessments passed through to you -Fraud experienced on compromised cards -Other reimbursements for fraud losses -Forensics, card replacement, PCI non-compliant fines, etc. Reputational impact: Potentially more damaging than the financial impacts, public trust and confidence in your organization can be negatively impacted by this type of data security breach 21

22 Fraud Servicing Scenarios Authorizations that need to be validated Posted fraud charges that require an account credit Outbound call to primary contact listed on account to verify activity If no answer, outbound call to secondary contact listed on the account If no answer at either telephone numbers or phone attempts can not be made, sent to primary contacts to ask for a return call Following fraud confirmation, the account will be closed and each transaction transferred to new account All transactions will appear on the new account number billing statement or your reporting tool Fraud will send a fraud statement to the Program Administrator or cardholder via , fax or regular mail Program Administrator or cardholder may be asked to complete Fraud Affidavit to comply with VISA and MasterCard regulations Credits for individual fraud transactions will appear on new account for balance reconciliation Once the credit is applied to the account, the claim is resolved Client action Call the Fraud department at or collect The department is available 24/7 to assist with questions or verification. 22

23 Managing Fraud Risk Fraudsters are increasingly targeting clients that conduct online business, employing sophisticated tools designed to compromise your system and surrender control of your computer. DOCUMENT an action plan now Develop a sound internal process for transactions using the highest industry standards. Communicate and enforce the plan across the organization. Create a separate plan to respond to an information compromise event. Keep in mind that an information breach may impact treasury activities. EDUCATE your team on best practices Establish other communication channels such as telephone calls, to verify significant transactions. Do not use the "reply" option to respond to an with transaction activity or approvals for payments. TAKE ACTION Bank experts and industry leaders share trends, tools and tactics for all business segments through video vignettes, case studies, podcasts, and featured white papers. Learn more: managing fraud risk website Consider solutions to help reduce your exposure to fraud. #1 Account Reconciliation MCC Restrictions Transaction Limits Two Way Alerts (Q1, 2016) FRAUD PROTECTION AND IDENTITY SAFETY CARD SOLUTIONS Source: Javelin Strategy & Research, 2014 To understand actions you can take to help your dealership reduce the risks associated with fraud, review online security tips and best practices to get started today. #1 AMONG ONLINE BANKING SERVICES PEERS Fraud prevention and monitoring Security administration and compliance Source: Greenwich Associates Online Services Benchmarking,

24 Chip & PIN / EMV

25 What is EMV chip technology? Chip Technology allows data to be stored and processed in a microchip A chip has 3 key functions that help to create a more secure payment solution: Data storage Cardholder identification and authentication Cryptographic processing EMV (Europay, MasterCard and Visa) is the global standard that defines how the chip card and terminal communicate 25

26 Magnetic stripe vs. chip technology Magnetic stripe Magnetic stripe technology: the technology acts as a passive carrier of card data, which is read and used by terminals, according to the rules programmed into the merchant device. The data is static and the card is passive in the transaction Issue: while U.S. fraud rates are statistically low, static data can be more easily captured by fraudsters and then used in fraudulent transactions without being detected Chip Chip Technology: a card with a chip can be configured to make authorization decisions, based on scenarios. For example low dollar, low risk transactions can be completed offline to increase acceptance Security: chip transactions are uniquely encrypted 100% of the time 26

27 Current EMV Situation US has 23% of card transactions, and over 47% of fraud, and growing Industry forecast is for slightly less than half of terminals EMV-enabled by Oct., 2015 How card usage will work: No chip card - use mag stripe like we do now Chip card, but no chip terminal use mag stripe like we do now Chip card and chip terminal use chip function with PIN Chip terminals may be present, but not functional in short-term Chip & PIN / Chip & Signature PIN environment: PIN mailers sent out separate from mailing of cards Cardholders must know PIN number PIN check website PIN numbers currently cannot be changed looking to a potential future enhancement to allow this 27 Clients being converted in waves Natural reissue / forced reissue Impact with logos, custom cards, and line characters

28 Questions?

29 Card statement re-design We are committed to delivering only the best Commercial Card solutions for all of our clients. With a focus on technology, service, innovation and our ever-increasing global footprint, we are in a position to deliver a comprehensive set of solutions with global and local proficiency. We are providing innovative solutions in more and more markets around the globe, in addition to investing in product development and resources to support our clients growth. Wherever you do business, you will benefit from a strong service model and a complete package of solutions that help you manage your working capital, operate more efficiently, reduce risk and gain visibility into your cash balances worldwide. KEVIN PHALEN HEAD OF GLOBAL CARD & COMPREHENSIVE PAYABLES 29

30 Notice to Recipient "Bank of America Merrill Lynch" is the marketing name for the global banking and global markets businesses of Bank of America Corporation. Lending, derivatives and other commercial banking activities are performed globally by banking affiliates of Bank of America Corporation, including Bank of America, N.A., member FDIC. Securities, strategic advisory, and other investment banking activities are performed globally by investment banking affiliates of Bank of America Corporation ("Investment Banking Affiliates"), including, in the United States, Merrill Lynch, Pierce, Fenner & Smith Incorporated and Merrill Lynch Professional Clearing Corp., both of which are registered as broker-dealers and members of FINRA and SIPC, and, in other jurisdictions, by locally registered entities. Merrill Lynch, Pierce, Fenner & Smith Incorporated and Merrill Lynch Professional Clearing Corp. are registered as futures commission merchants with the CFTC and are members of the NFA. Investment products offered by Investment Banking Affiliates: Are Not FDIC Insured * May Lose Value * Are Not Bank Guaranteed. This document is intended for information purposes only and does not constitute a binding commitment to enter into any type of transaction or business relationship as a consequence of any information contained herein. These materials have been prepared by one or more subsidiaries of Bank of America Corporation solely for the client or potential client to whom such materials are directly addressed and delivered (the Company ) in connection with an actual or potential business relationship and may not be used or relied upon for any purpose other than as specifically contemplated by a written agreement with us. We assume no obligation to update or otherwise revise these materials, which speak as of the date of this presentation (or another date, if so noted) and are subject to change without notice. Under no circumstances may a copy of this presentation be shown, copied, transmitted or otherwise given to any person other than your authorized representatives. Products and services that may be referenced in the accompanying materials may be provided through one or more affiliates of Bank of America, N.A. We are required to obtain, verify and record certain information that identifies our clients, which information includes the name and address of the client and other information that will allow us to identify the client in accordance with the USA Patriot Act (Title III of Pub. L , as amended (signed into law October 26, 2001)) and such other laws, rules and regulations. We do not provide legal, compliance, tax or accounting advice. Accordingly, any statements contained herein as to tax matters were neither written nor intended by us to be used and cannot be used by any taxpayer for the purpose of avoiding tax penalties that may be imposed on such taxpayer. For more information, including terms and conditions that apply to the service(s), please contact your Bank of America Merrill Lynch representative. Investment Banking Affiliates are not banks. The securities and financial instruments sold, offered or recommended by Investment Banking Affiliates, including without limitation money market mutual funds, are not bank deposits, are not guaranteed by, and are not otherwise obligations of, any bank, thrift or other subsidiary of Bank of America Corporation (unless explicitly stated otherwise), and are not insured by the Federal Deposit Insurance Corporation ( FDIC ) or any other governmental agency (unless explicitly stated otherwise). This document is intended for information purposes only and does not constitute investment advice or a recommendation or an offer or solicitation, and is not the basis for any contract to purchase or sell any security or other instrument, or for Investment Banking Affiliates or banking affiliates to enter into or arrange any type of transaction as a consequent of any information contained herein. With respect to investments in money market mutual funds, you should carefully consider a fund s investment objectives, risks, charges, and expenses before investing. Although money market mutual funds seek to preserve the value of your investment at $1.00 per share, it is possible to lose money by investing in money market mutual funds. The value of investments and the income derived from them may go down as well as up and you may not get back your original investment. The level of yield may be subject to fluctuation and is not guaranteed. Changes in rates of exchange between currencies may cause the value of investments to decrease or increase. We have adopted policies and guidelines designed to preserve the independence of our research analysts. These policies prohibit employees from offering research coverage, a favorable research rating or a specific price target or offering to change a research rating or price target as consideration for or an inducement to obtain business or other compensation. Copyright 2014 Bank of America Corporation. Bank of America N.A., Member FDIC, Equal Housing Lender. 30