RDC Risk Management in 2013

Transcription

1 RDC Risk Management in 2013 Paul Carrubba, Partner Adams and Reese, LLP John Leekley, Founder & CEO RemoteDepositCapture.com

2 Legal and Regulatory Issues No Mobile Banking Law Federal Laws and Regulations State Laws and Regulations Operating Rules 2

3 Federal Laws and Regulations U. S. Patriot Act Bank Secrecy Act/ Anti-Money Laundering EFTA Reg E TILA Reg Z TISA Reg DD GLBA Reg P FFIEC Guidance and IT Handbooks ESIGN Licensing Requirement 3

4 State Laws and Regulations UCC Article 2 UCC Articles 3 & 4 UCC Article 4A Privacy Laws UETA State Banking Regulation Licensing Requirements

5 Customer Agreement Part of Internet Banking Stand Alone Remote Deposit Consumer Business ESIGN

6 Anti-Money Laundering Assessment of Civil Money Penalties Bank Assessed $8,000,000 Violated Internal Policies, Procedures and Controls Failure to Monitor and Manage Risk of RDC Technology Failure to Monitor and Manager Risk of Wire Transfer Activity Correspondent Accounts for Non-United States Persons Failure to Designate Compliance Personnel Violation of Requirements to Report Suspicious Activity

7 Penalties, cont. Bank Assessed $110,000,000 Failure to Implement Internal Policies, Procedures and Controls Failure to Manage Risk of RDC Failure to Monitor Pouch and Cash Letter Activity Failure to Designate Compliance Personnel Ineffective Program for Independent Testing for Compliance Violations of the Requirement to Report Suspicious Activity Failure to file CTR

8 RDC FRAUD LOSSES Duplicates Check Kiting Deposit of Image and Original Forged Endorsement Employee Theft of Checks Commercially Reasonable Security Procedures

9 Discussion Objectives Legal & Regulatory Foundation Penalties, Losses & Frauds Setting the Stage Definition of RDC Risk Management Guidance Tools of the Trade Risk Management Tactics & Strategies Leveraging KYC, System Functionality The Latest & Greatest Kicking the Tires RDC Risk Management Update

10 RDC is a Payments Platform RDC Applies to a family of related products & services most often differentiated by location of check capture. Remote Deposit Capture Corporate Merchant Consumer Mobile Teller Branch Lockbox ATM Correspondent The term Remote Deposit Capture refers to the process of electronically capturing check images and data, transmitting that information for deposit and clearing, and truncating the original paper checks. This definition is evolving to include additional payment types, including card payments. RDC is becoming an integrated technology platform increasingly used to process different types of payments and data with the ability to feed that data to systems both internal and external to the organization. Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 10

11 RDC is a Delivery System RDC is a Payments & Data Processing System Scope of implementation and exposure Should be incorporated into existing risk management process Governance, Oversight & Tactics will, and should, vary by institution Non-Public Personal Information Complexity of Risk Identification will vary Internal IT systems, Third-Party Solution Providers Involve relevant stakeholders FFIEC Guidance Mitigate Monitor Measure Actionability & Sustainability Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 11

12 RDC is Safe! RDC is NOT a new payment type, just an enhanced channel Leverages online & mobile technologies Leverages Processes and Risk Management Better ability to identify risks Traditional Fraud reduced through faster clearing Better, Automated Data than pre-rdc Risks Unique to RDC: Managing the Original Bait & Switch Duplicates Original Document Alterations The greatest risk unique to RDC lies in the use and handling of the original document. These risks can be overcome with sound risk management practices. Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 12

13 Regulatory Guidance Overview 1. FFIEC RDC Risk Management Guidance released January 14, 2009 RDC risk management process in an electronic environment Focusing on RDC deployed at a customer location Principles of RDC risk management discussed are applicable to: FI s Internal deployment ATM, Branch, Cash Vault Other forms of electronic deposit delivery systems (e.g., mobile banking and automated clearing house [ACH] check conversions). 2. Retail Payment Systems Booklet {& RPS Examination Procedures (N), (M)} February 10, Version of the Bank Secrecy Act/Anti-Money Laundering Examination Manual Updated April 29, Authentication in an Internet Banking Environment October 12, Supplement to Authentication in an Internet Banking Environment June 22, 2011 Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 13

14 Three Pillars of the FFIEC Guidance Responsibility Senior Management Board Risk Identification & Assessment Internal External Process Mitigation & Controls Planning Measure Monitor Report Risk Identification Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 14

15 Risk Environment Identification Identify Key elements of the RDC environment Internal Third-Party Markets/Customer/Capture Devices Identify Responsible staff members and risk management team Internal Staff: Product Manager, Risk, Treasury, Sales, etc External: Technology Provider, Processor, etc. Review: Volume reports ($ s and Transactions) Network design at the FI, Service provider and customer Dataflow maps and logical system diagrams The risk management process Report review process Establish Relevant Contracts & Agreements Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 15

16 Risk Reporting and Monitoring Checklist Examples Develop a Risk Audit Checklist Example Written RDC Policies and Procedures Document Legal Agreement needs periodic review Customer Selection, rules and limits Establish thresholds and limits for volume, velocity and value Monitoring and review of accounts for duplicates, rejected and returned items Monitor internal, partner and customer processes: Security and Access Separation of responsibilities Establish procedures for regular reporting Deposit history and to identify patterns Periodic training, s or letters to customers RDC included in audit process Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 16

17 RDC & Enterprise Risk Management OFAC Compliance Automate Suspicious Activity Reports Adhere to Sanctioned Country List BSA / AML Logical Approach to Enhanced Due Diligence Know Your Customer & KYCC Integrate Check with Enterprise Monitoring Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 17

18 BSA / AML & OFAC Bank Secrecy Act/ Anti-Money Laundering Examination Manual New RDC Highlights 1. Senior management should identify BSA/AML, operational, information security, compliance, legal, and reputation risks. 2. Conducting appropriate customer CDD and EDD. 3. Obtaining expected account activity. Case Studies: Wachovia: $160MM Fine Dallas Community Bank, T-Bank: $5.1MM Zions, HSBC, FL, etc. RDC must be integrated into a bank s AML / BSA risk management and reporting activities. Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 18

19 Oversight and Audit Guidance by local FDIC examiner: Think of the spirit of RDC guidance and apply to this new channel. Adding mobile RDC to Board-level RDC Policy Use automated routines that will address KYC and risk management Account activity review Limits Holds Duplicate check detection KYC Know Your Customer is Always Key Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 19

20 Key Information: Know Your (Biz) Customer Understand Business Finances, Customers, Processes CDD (Customer Due Diligence, EDD (Enhanced Due Diligence, CIP (Customer Identification Program) Understand Deposits Obtain History Volumes & Values of Items, deposits, returns, Velocity Use this data to custom-fit RDC Thresholds, Limits, Holds & Availability Schedules Separation of Duties, Approvals Functional Capabilities Pricing, Balances, monitor deposit & data trends. RDC Should be customized to each individual client. Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 20

21 Leverage the KYC you ve already done Customer selection and KYC Review process at the FI who is involved and what level of management Risk rating system Elements included in decision criteria User / Location / Account Parameters - Identify & Prevent Fraud & Mistakes. Client Deposit Trends Ensure metrics, safeguards are relevant. Availability Schedules & Holds - Don t blindly make short-term loans, allow for returns, effective way to deal with questionable items. Balances Competitive advantage, strengthens balance sheet, maximizes revenues and minimizes losses. Even with minimal KYC, risks can be adequately handled through effective employment of standard risk management techniques. Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 21

22 Validation Rules and Work Types Define Systemic Rules & Thresholds Image Quality Field Validation Item type acceptance Balancing Rules Target Functionality by Client Group Excellent Customers New Customers Risky Customers Source: Fiserv Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 22

23 Oversight and Monitoring Locations Financial institution Vendor Customer Operational benchmarks Key risk metrics Performance metrics Management Review Who and how Frequency &Timeliness Accurate Point-in-time Trend RDC Product Individual customer Aggregate customers Type of Reports Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 23

24 Education & Training Education & Training FI associates and customers Most customers will want to protect themselves System Operation & Process Safekeeping & Destruction of original items Risks & the role of the customer and the FI Duplicate Presentment Information & Data Problem Resolution Periodic s or letters to customers to remind them of their responsibilities for: training, security, process, check retention, endorsements, adequate safeguards for storage of checks and account information AML / BSA Training Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 24

25 Separation of Duties Split responsibilities and procedures for: Account set up and Deposit review, approvals and reconciliation at the FI System security review procedures At the customer location separation of duties Capture (scan) and send deposits or for review of reports of deposits sent and for reconciliation. Other controls Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 25

26 RDC Systemic & Targeted Risk Management Systemic Risk Management Enterprise Risk Management AML / BSA / Payment Validation & Reporting System-Wide Risk Management Duplicate Detection, Image Quality / Usability Reporting & Audit Functionality Legal Agreements Targeted Risk Management Source Merchant, Consumer, Mobile, Branch, ATM etc. Domestic, International Trend Analysis & Patterning Item / User Limits & Thresholds Holds, Availability, Balance Requirements, Customer Selection, etc. Optimal RDC Risk Management should be tailored to each end-user, location and device, yet leverage system and enterprise risk management capabilities. Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 26

27 Tactics for RDC Risk Management Traditional Client Selection Credit Relationship Balances History Thresholds Daily and Monthly Deposit $ & Volume Limits Availability Evolving Client Selection Leverage KYC History & Monitoring Balances Availability Thresholds (Dynamic) Daily and Monthly Deposit $ & Volume Limits Endorsement Identification Verification & Guarantee Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 27

28 Fraud Monitoring & Prevention Monitoring Process to identify potential fraudulent items Real-time Systems Mitigate Risk before / as it happens Return Item Monitoring Adjustments! Some Duplicate Items returned this way. Functionality duplicate detection, deposit limits, pattern identification, safeguarding check Restrict Functional Capabilities by location Minimize Fraud Opportunities. Foreign location identification and monitoring Mobile Deposit Positive / Negative Databases The data is out there! Internal: Build Track Record External: Developing Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 28

29 The Importance of Endorsements Endorsements can help prevent duplicates Restrict deposit to a specific bank & account Legal & Regulatory implications Appropriate endorsement can be identified Teller Payor Systemic Identification Decreases likelihood item will be used Criminals can also see the restrictive endorsement Systemic Capabilities are evolving Hardware & Software Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 29

30 Greatest Threat: Duplicates Duplicates / Cashing Fraud One Check, Multiple Deposits Depository FIs Clearing Returns Paying / Bank Final Step, Check Cashed Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 30

31 Potential RDC Losses: Duplicates RDC Deposit ( Duplicates ) Fraud Definition: Process by which criminal is able to deposit the same legitimate or fraudulent item at several FIs, then withdraws the funds before items are returned. Criminals Look For Minimal KYC No Balance Requirement No Holds Immediate Availability No / High $$$ Limits Risk Management Beware of Customers who don t keep balances. Require Balances! Holds on New Customers, High $$$ Availability Schedules $$$ Thresholds Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 31

32 Risk Management Duplicate Detection Duplicate Detection should ideally be done across all levels & accounts, channels and products. Levels & Accounts User, Location, Account Channels RDC Location, Lockbox, ATM, Branch, Mail Drop, Kiosk & Inclearings, etc. Products Check and ACH (for converted items) Network All banks using a specific service provider Industry Recent Industry Developments / Early Solutions Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 32

33 Potential RDC Losses: Bait & Switch The Con: 1. Obtain Legitimate Check From Victim. 2. Deposit Using RDC 3. Return Original to Victim 4. Ask Victim to provide funds via alternate method Result: Criminal gets paid twice by legitimate payment types, once by check, once by wire. Prevention: Stop Payments on Check, Positive Pay, Client Education, delayed availability, deposit limits, endorsements Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 33

34 Recourse is Essential In the worst-case scenario, how can the FI retrieve funds? Availability Schedules Key: Provide availability to account for potential returns based upon Client Risk Profile. Required Balances Key: Can enable FI to actually earn more revenues while also providing a reserve against returns. Adds to Deposits, Capital, Liquidity, Loan Capabilities. Credit Relationship? Interesting concept, but does not enable FI to have access to funds. Customer already owes FI $$$. Verification & Guarantee Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 34

35 Site Visits?? When Warranted Site Visit Define risk levels (Define When Warranted ) Returns, Duplicates, Availability Assignment, Deposit Thresholds, Volumes, New Clients, combination of metrics, etc. Leverage Monitoring & Reporting (Actionability) When Appropriate Self-Assessments Apply same evaluation items as a site visit Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 35

36 Testing Risk Management Risk Control / Risk Type Operational Error Check Kiting Duplicate Error Duplicate Fraud Value Fraud Volume Fraud FIs should have at least 150 Total Points per risk type, 200+ for Fraud Risk Types. Return Items IQU / IQU / CAR / LAR Value / Volume Thresholds RDC System DD Cross-Channel DD Industry DD Balances Holds Availability Schedules Monitoring & Actionability Verification & Guarantee Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 36

37 Client RDC Risk Management Top Ten 1. Control the Original, leverage the system, establish a process. 2. Understand the Cons 3. Utilize Duplicate Detection 4. Setup Automated Reports & Alerts 5. Separation of Duties 6. Have a Backup Plan 7. Restrictively Endorse All Items 8. Deposit Items QUICKLY! 9. Safekeep / Destroy all items (& Reconcile) 10.Implement Positive Pay Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 37

38 Optimal Risk Management 10 Steps to Minimize RDC Risk: 1. Client Selection / KYC Leverage KYC Information to setup parameters. 2. User / Location / Account Parameters - Identify & Prevent Fraud & Mistakes, manage exceptions 3. Education & Training - Most customers will want to protect themselves. 4. Functionality Restrictions Minimize Fraud Opportunities. 5. Availability Schedules & Holds - Don t make short-term loans, allow for returns, effective way to deal with questionable items. 6. Positive / Negative Databases, Verification & Guarantee 7. Integration & Reporting Monitor client deposit trends, integrate into bankwide risk management systems (AML / BSA for example). 8. Real-time Systems Manage systems, Mitigate Risk before / as it happens 9. Balances Competitive advantage, strengthens balance sheet, maximizes revenues and minimizes losses. 10. Accelerate Clearing & Returns Faster Clearing can reduce potential losses. Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 38

39 The Road Ahead Mass Adoption of Mobile RDC FIs, Third-Parties & Consumers Increasing Role of 3 rd -Party Solutions Paypal, Intuit, ISOs, ISVs, AFS (Alternative Financial Services), etc. RDC as a Payments Platform Checks, Cards, ACH, Cash Data: The final frontier? Questions: Does a Check even need to be paper?? Will a centralized database for duplicates evolve? Will checks regain popularity? Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 39

40 Join the discussion As the RDC Industry continues to evolve, so too must the approach to RDC Risk Management. Visit RemoteDepositCapture.com for the latest & greatest on this topic, and everything RDC. We ve even setup a dedicated discussion forum to help the industry continue the conversation. Click Here to join the discussion. Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 40

41 A Unique Perspective RemoteDepositCapture.com is an independent information & services resource for the Payments Industry. We are NOT a reseller, solution provider, etc. We ARE experts in, and an open resource for the industry. We work with the vast majority of leading solution providers, FIs, processors. Thousands of FIs, corporations, businesses and consumers visit the site each month. We are supported by many industry-leading organizations. We were involved in the formulation of the FFIEC RDC Risk Management guidance and training of over 1,200 auditors. Services News & Research The RDC Solution Finder Solution Provider Directories RDC Overviews White Paper Central FREE Webinars The RDC Summit and much, much more. Contacts: John.Leekley@RemoteDepositCapture.com Copyright 2013, Remote Deposit Capture, LLC 2013 RDC Risk Management Update 41