Remote Deposit Terms of Use and Procedures

Transcription

1 Remote Deposit Terms of Use and Procedures Use of American National Bank Fox Cities (Bank) Remote Deposit service is subject to the following Terms of Use and Procedures. Bank reserves the right to update the Terms of Use and Procedures at any time without notice. General Bank personnel may come to the user s place of business to monitor compliance with the Terms of Use and Procedures and applicable law. The Business agrees to use a scanner model and type that has been provided by the Bank. The Business must have at least one checking account at the Bank, be an Online Business Banking user, have a valid address, and sign the Remote Deposit Agreement. The system can be used to send check images for deposit only to accounts designated in the Remote Deposit Agreement. Changes in daily deposit limit, related entities, and users can be made only by the Remote Deposit Authorized Representatives designated in the Remote Deposit Agreement. Business will limit remote deposit access to their accounts to the users identified in the Remote Deposit Agreement. The bank is not obligated to monitor transactions through the system to determine if they are made on behalf of the Business. Processing Days Monday through Friday, excluding holidays. Non Processing Days (Holidays) When holiday falls on a Sunday, the following Monday is a non-processing day. New Year s Day Martin Luther King Jr. Birthday President s Day Memorial Day Independence Day Labor Day Columbus Day Veteran s Day Thanksgiving Day Christmas Day Cut Off Time Deposits successfully submitted prior to 8PM on a processing day are posted to your account the same business day. Deposits submitted after 8PM on a processing day or a non-processing day will be posted the next business day. Service Availability Remote Check Deposit is available 24 hours a day, 7 days a week, including weekends and holidays. Page 1 of 5

2 Service Unavailability Notify the Bank as soon as possible if the Remote Check Deposit is not available. During the time that the service is unavailable you may make deposits physically at the Bank. Deposit Verification The Deposit Detail Report will tell you the status of the deposit. If the status does not say submitted, deposit has not been received by the bank. The report will state the checking account number, the deposit total, and a listing of the checks deposited. Call the Bank as soon as possible if there are any discrepancies or if you do not receive the report. Workstation Requirements Business is responsible, at its expense, for procuring and maintaining communications & computer equipment and connections according to the following workstation requirements: Disk Space 10 GB of available disk space on the system drive recommended Hardware 2.0 GHz (or higher) processor recommended 2 GB of RAM (or higher) recommended Operating System Microsoft Windows Vista 32 Bit OR Microsoft Windows XP Service Pack 2 Software Microsoft Internet Explorer 6.0 or 7.0 Service Pack 1 Appropriate Ranger Device Driver varies depending on the scanner in use. Important Notes: The PC on which Branch Source Capture is installed must be defined as a trusted site on the workstation. ( User must be a Local Administrator on the PC Internet connection/wired Ethernet Network Interface Card connection/dsl, ASDL, Cable, T-1 (with Internet access of 1.5 megabits per second (MBPS) connection or higher)internet access If client PC must connect to the Internet through a corporate firewall, the firewall must be configured to allow HTTPS requests (port 443) to the Merchant Capture web server and receive corresponding HTTPS responses. This is a secure Internet connection over port 443 using 128 bit encryption. If a proxy server is being used, it may need to be configured to allow access for the Merchant Capture application. Workstation and Scanner Security Restrict physical access to workstation and scanner. Locate workstation and scanner, where feasible, in an area that has restricted traffic flow. Ideally, the equipment would be in an office with access by only those authorized to access the application. Secure Check and Report Storage and Destruction Secure checks prior to, during, and post scanning and transmission. If the scanning process is interrupted, the checks should be secured physically and the user logged out of the application. Once the Page 2 of 5

3 scanning process is complete and the files have been transmitted, the checks should be stored in a secure (under lock and key) location under dual control until they are destroyed. Checks are to be shredded, (dual control recommended), after a reasonable period of time, but not less than 60 days. An audit log that records the date of destruction, batch numbers, and initials of those performing the shredding should be maintained. The detailed reports retrieved from the SCO system should be kept either secured with the checks or in a secured file on the computer. They contain sensitive information that must be handled securely. The detailed reports need to be destroyed, if physical, and removed from the system, if electronic, after 60 days. The detailed reports must be kept and destroyed in the same manner as the checks. 1. Store all original checks in a safe or lockbox, accessible only by authorized personnel. 2. Do not store customer account information, photocopies, or private information in files that are accessible by non-authorized personnel. 3. Maintain a filing system that easily identifies any missing checks. Suggestions: a. Store a paper copy of each deposit receipt with the original checks. b. Store the checks in chronological order. c. Maintain an accurate count of checks you have stored at any time. 4. Use a cross cut paper shredder on site or hire a third part service for the secure destruction of checks. 5. Use a locked or secure trash bin for the disposal of shredded checks. Your Operational Responsibilities 1. Maintaining at least one checking account at the Bank eligible for the receipt of deposits. 2. Performing initial installation procedures as described in the Remote Deposit Installation Instructions. 3. Using the system only for internal business purposes. 4. Preserving the confidentiality of any User ID, Password, or other authentication method provided by the bank. 5. Preventing the use of the system by unauthorized persons. 6. Installing and implementing any changes and upgrades to the system as required by the Bank. 7. Ensuring the equipment is clean and operating properly at all times. 8. Inspecting and verifying the quality of the images of the front and back of the original checks and that the image contains all endorsement from the original check. 9. Depositing checks that are in US dollars and are drawn on or payable through a US financial institution. 10. Depositing checks through the system that have not been previously presented and paid. 11. Entering the correct dollar amount of each check image. The software will read and automatically fill in the check amount in most cases. 12. Ensuring the MICR line information from the original check is accurately scanned, entered, or repaired for each check image. 13. Ensuring each deposit is in balance before it is submitted to the Bank. 14. In the event of a lost, mistaken, unusable, or fraudulent electronic check image, cooperating fully with the Bank in providing information about the image. 15. Maintaining control over and securely storing the original checks that have been electronically submitted to the Bank. Recommended Workstation & Network Security To achieve logical security, it may be necessary to engage an outside network consultant to configure network and workstation security. Page 3 of 5

4 Install and maintain a firewall on the network. Consideration should be given to installing a personal firewall on the workstation or enabling the Windows firewall if using a Windows operating system. The firewall should be configured to disallow traffic from untrusted networks and restrict inbound and outbound Internet traffic. Direct public access must be prohibited. The firewall should be kept up to date and monitored. Ensure the firewall has audit logging capabilities. Install and maintain anti-virus and anti-spyware tools on the workstation. The tools should be capable of generating audit logs and kept up to date. If wireless networks are deployed, ensure that wired equivalent privacy (WEP) is enabled, default service set identifier (SSID) broadcasts are disabled, and vendor default settings are changed. WiFi protected access (WPA and WPA2) encryption and authentication should also be enabled. Restrict use of peer to peer (P2P) networks and file sharing capabilities. Restrict remote access. If remote software is installed ensure it is secure or prohibit installation PC Anyware, GoToMyPC, etc. Do not allow outside software to be loaded on the workstation. Restrict or prohibit Internet downloads. Vendor supplied default system passwords must be changed. This includes Windows and RDC application software. Ensure that each user of the system has their own ID and password. Log on credentials should never be shared since it negates any audit trail. Strong password parameters are encouraged. Minimum length of 8 characters and including alpha/numeric and special characters for both the network and RDC application is recommended. Passwords should not be associated with any commonly known personal identification, such as social security numbers, address, date of birth, names of children. Passwords should expire within 30 to 60 days. Network settings should log users off after 10 minutes of inactivity. Ideally the workstation should have a password protected screen saver enabled. Consider multi-factor authentication by installing biometric readers. Network and workstations should have the latest vendor supplied security patches installed. Industry practice is to install relevant security patches within one month of release (or sooner, following testing to ensure interoperability [Windows updates should be researched prior to installation]); however, anti-virus, anti-spyware, and firewall definitions should be automatically installed immediately upon release. Establish a process to identify newly discovered security vulnerabilities: subscribe to alert services available on the Internet and run an automated application on the network to identify vulnerabilities. Consider annual penetration testing. Limit Internet access and restrict webmail access for added protection against potential viruses, Trojans, and key loggers. Review system event logs and user activity logs, especially those with administrator profiles. Page 4 of 5

5 Maintain system backups. Consider segregation of duties between initial scanning of items, edits to images, and transmission of the files. At a minimum, a review of all manual adjustments to check images should be reviewed by someone other than the person making the changes to ensure accuracy. Caring for the Scanner Scanners should be placed at least 18 inches from other electronic equipment. Do not insert checks that could damage the scanner, such as stapled checks. Use compressed air to frequently clean the scanner. This eliminates dust and paper fragments that may damage the scanner. If your scanner fails to operate, call for assistance. Page 5 of 5