[regulatory compliance. Advisor] Important Upcoming Compliance Dates. An Update for Community Bank Executives Issue One

Transcription

1 2010 Issue One Advisor] [regulatory compliance An Update for Community Bank Executives Important Upcoming Compliance Dates ken evans larsenia horton innessa levina john mull Regulatory compliance is always changing. The calendar below is intended to assist with planning and to address requirements related to federal consumer protection and other regulations. Information contained in the calendar is designed to serve as a reminder of relevant dates to complete tasks associated with regulatory matters. We highly recommend you consult the referenced law or regulation for specific details as may be appropriate. April 1, 2010 April 1, 2010 June 1, 2010 July 1, 2010 July 1, 2010 July 1, 2010 August 22, 2010 October 1, 2010 January 2011 January 2011 CRA Public File annual update Effective date for TILA/Regulation Z escrow requirements for high priced mortgage loans secured by site built homes (but not manufactured homes) Extended deadline for implementation of Unlawful Internet Gambling Enforcement Act (Regulation GG). The original deadline was December 1, 2009 (See article in this bulletin) Effective date for TILA/Regulation Z changes to open end credit (not home secured) Effective date for implementing procedures to enhance the accuracy and integrity of information furnished to consumer reporting agencies under Section 312 of the FCRA Reg E opt in requirement for overdraft on ATM and one time debit card transactions (See article in this newsletter) Effective date for TILA/Regulation Z Credit CARD Act provisions, including reasonableness/proportionality of penalty fees/charges and re-evaluation by creditors of rate increases Effective date for TILA/Regulation Z escrow requirements for high priced mortgage loans secured by manufactured homes Expiration of current safe harbor for banks that rely on previous Privacy disclosures. New models are to be delivered to consumers no later than January 2011 Implementation date for Risk-Based Pricing Notice as part of the FACT Act of 2003 (Section 311) which creates a new Section 615(h) for the FCRA

2 [ Plante & Moran regulatory compliance Advisor ] New Overdraft Rules Related to ATM and One-Time Debit Card Transactions Changes to certain overdraft rules are scheduled to take effect on July 1, It is important to note that these rule changes do not affect all transactions that result in overdrafts; rather, they are focused specifically on ATM and one-time debit card transactions that cause a consumer account to be overdrawn. The new rules, part of the finalized amendments to Regulation E, will enable consumers to limit the cost of overdraft services for ATM and one-time debit card transactions. As part of the change, banks will need to provide consumers with clear disclosure of the fees and terms associated with the provided overdraft service and consumers will need to positively acknowledge the terms associated with the provided overdraft service ( opt-in ) if they wish to maintain overdraft privileges. Consumers will soon choose to have or not to have overdrafts for debit cards and ATM transactions paid for a fee. In the past, some banks automatically enrolled consumers in their standard overdraft services for all types of transactions when they opened an account. Under the new rules, the bank must first get the consumer s permission to apply these services to everyday debit card and ATM transactions before they can be charged overdraft fees. To grant this permission, the consumer will need to respond to the notice and opt in (agree). The rule applies only to overdraft fees or charges arising from paying an ATM or a one-time debit card transaction. The rule applies to: Any ATM withdrawal, including those at proprietary or foreign ATMs All transactions originating at an ATM that overdraw a consumer s account, not just withdrawals Any one-time debit transaction whether it is made at the point-of-sale, online, or by telephone Any fee charged on an account pursuant to an overdraft service is subject to the rule, including, but not limited to, per item, per occurrence, daily, sustained overdraft, or negative balance fees. In those instances in which a negative balance is attributable to mixed transactions (i.e., check, ACH, or other recurring debit card transaction and ATM or one-time debit transactions) a bank may charge a sustained overdraft fee, even for customers who have not opted in. For existing accounts, if a consumer does not opt in (agree), beginning August 15, 2010, the bank cannot charge a fee for overdrafts caused by everyday debit card and ATM transactions. For those consumers who have not opted-in, banks are expected to decline attempted transactions when the consumer does not have enough money in the account since overdraft fees cannot be charged. If a consumer opens a new account on or after July 1, 2010, the bank cannot charge overdraft fees for everyday debit card and ATM transactions unless the consumer opts in. If a consumer opens a new account before July 1, 2010, the bank should treat the consumer as an existing account holder and they would receive a notice about the bank s overdraft services and will have to decide if they want overdraft privileges for everyday debit card and ATM transactions. Whatever the decision, the new overdraft rules give the consumer flexibility. If a consumer opts in, they can cancel at any time. If they do not initially opt in, they can opt in later. Note that the new rules do not apply to checks or automatic bill payments that a consumer may have set up for paying bills such as their mortgage, rent, or utilities. The bank may still continue or automatically enroll a consumer in standard overdraft services for these types of transactions. If a consumer does not want the bank s standard overdraft services in these instances, the consumer must discuss this with the bank and may or may not have the option to cancel. The rule does not prohibit a bank from paying an overdraft for an ATM or a one-time debit card transaction if the customer has not opted-in; it only bars the bank from assessing a fee. Furthermore, the rule does not require a bank to authorize or pay any overdrafts on an ATM or one-time debit card transaction, even if the consumer has affirmatively consented. b a n k s a r e ex p e c t e d t o d e c l i n e attempted transa c t i o n s w h e n t h e c o n s u m e r d o e s n o t h a v e e n o u g h m o n e y in the account Some banks do not offer customers an overdraft privilege for debit cards or ATM transactions. If the bank never allows overdrafts for debit card or ATM transactions and does not charge a fee for the attempt to overdraw the account, then the bank would not be subject to these new Regulation E requirements. Regulation E defines the notice requirements and provides a model notice to facilitate communication with consumers. As you prepare for implementation, don t forget to consult your core processor, EFT network, and any vendors to determine the system capabilities that will impact compliance with the new rules. Other must do s include designing a system to monitor opt-in status, revising system parameters that automatically process transactions that could result in overdrafts, and training operations and all front line employees on how to process transactions and address customer concerns. 2

3 [ Issue One 2010 ] The Unlawful Internet Gambling Enforcement Act and Regulation GG The Unlawful Internet Gambling Enforcement Act (UIGEA) of 2006 prohibits gambling businesses from knowingly accepting payments in connection with unlawful Internet gambling, including payments made through credit cards, electronic funds transfers, and checks. This Act was passed in 2006 but the implementing regulation will be effective June 1, 2010 (delayed from the original effective date of December 1, 2009). The regulation requires banks that participate in designated payment systems to establish and implement policies and procedures that are reasonably designed to prevent payments to gambling businesses in connection with unlawful Internet gambling. The rule provides non-exclusive examples of such policies and procedures and sets out the regulatory enforcement framework. For purposes of the rule, unlawful Internet gambling generally would cover the making of a bet or wager that involves use of the Internet and that is unlawful under any applicable federal or state law in the jurisdiction where the bet or wager is initiated, received, or otherwise made. The regulation requires compliance by banks in four general areas: Screening commercial customers at account opening Policies and procedures to block prohibited transactions conducted via debit and credit cards Policies and procedures to follow when a commercial account processes restricted transactions New notice requirements for commercial customers By June 1, 2010, banks must have written policies and procedures in place that demonstrate the steps they are taking to prevent a commercial entity acting as an online casino from opening an account. Most banks are meeting these requirements already under the know your customer requirements, but they should formally incorporate the UIGEA requirements into their existing procedures in order to demonstrate compliance. When a new customer applies to open an account: Determine whether the account is for an individual or a commercial entity. If it is for an individual no further action is required under the UIGEA final rule. If it is a commercial entity, the bank, as part of its normal due diligence, should assess whether there is a minimal risk of it acting as an Internet gambling business. If so, then no further action is required under the UIGEA final rule. If a bank is not able to determine if a commercial applicant has a minimal risk of acting as an Internet gambling business, they can rely on the applicant s own certification that they do not operate an as an Internet gambling business. If a bank determines that an applicant does operate an Internet gambling business, it can still open the account if additional standards are met. Banks will be obligated to establish written policies and procedures to block transactions financing wagers of unlawful Internet gambling that are made via credit and debit cards. Banks that issue credit and debit cards can rely on policies and procedures developed by the card system operators (Master- Card, Visa, American Express, Discover) to block prohibited transactions; however, copies of the card system operators policies and procedures that the bank will be relying upon need to be obtained and kept in the bank s possession. A bank must establish written policies and procedures describing remedial actions it will take if it discovers that a commercial account is processing restricted transactions. The final rule does not mandate any specific actions that must be taken, but relies on each participant to have established policies and procedures in place. The final rule requires that banks communicate to their commercial customers that restricted transactions are prohibited under UIGEA. However, the regulation is flexible regarding how the communication is made. It could be made through a revised commercial account agreement for new customers, via a notice sent to established commercial customers, or possibly even through some other methods including even a notice on the bank s website as long as the commercial account holders are reasonably likely to receive it. Banks are not required to update account agreements or provide notice with a periodic statement to comply with this UIGEA requirement. Th e fi n a l r u l e r e q u i r e s t h a t b a n k s c o m m u n i c a t e to t h e i r c o m m e r c i a l c u s t o m e r s t h a t r e s t r i c t e d t ra n s a c t i o n s a r e p r o h i b i t e d u n d e r UIGEA. As noted earlier, the mandatory compliance date was delayed to June 1, There is a potential that Congress may change the law prior to June 1, 2010, but if there are no late law changes, the rule is expected to be effective as it is written. The banking agencies are expected to issue examination guidelines for compliance with UIGEA as we get closer to June

4 [ Plante & Moran regulatory compliance Advisor ] Preparing for the SAFE Act The Secure and Fair Enforcement for Mortgage Licensing Act of 2008 (SAFE Act) became law in July 2008 as part of the Housing and Economic Recovery Act of The SAFE Act is intended to improve the accountability and tracking of residential mortgage loan originators (MLOs), enhance consumer protection, reduce fraud, and provide consumers with easily accessible information regarding the professional background of MLOs. This Act, unlike many other compliance acts, involves both state and federal elements. The Act authorizes HUD to develop and implement a loan originator registration process for any state that does not develop an adequate system. The Act also covers MLOs who are not employed by financial institutions; those individuals are also subject to new state licensing requirements. In accordance with the SAFE Act, all MLOs, including those employed by federally-regulated depository institutions, must register with the newly created Nationwide Mortgage Licensing System and Registry (NMLSR). Each person will be assigned a unique identifier to be used with MLO transactions. Who Meets the Definition of an MLO? An MLO is an individual who takes a residential mortgage loan application and offers or negotiates the terms of a residential mortgage loan for compensation or gain. As with most definitions, there are exceptions to the MLO definition for SAFE Act purposes. Activities excluded by the SAFE Act are those that pertain to: administrative or clerical tasks As employers, institutions will need to develop written policies, ensure their employees acting as MLOs are aware of the requirements, and ensure those employees are properly registered and comply with the requirements. The earliest date for states to comply with the SAFE Act is July 31, 2010; however, the NMLSR, federal banking agency requirements, and individual state requirements most likely will not be available by that time. Watch for future updates as to the status of the SAFE Act. You are encouraged to also monitor recent developments through your primary federal regulator or the Nationwide Mortgage Licensing System website at org. real estate brokerage activities loan processing or underwriting under the direction and supervision of an MLO individuals solely involved in extensions of credit relating to timeshare plans Under a proposed de minimis exception, an employee of a federally-regulated institution would not have to register as a MLO if he/she originated five or fewer loans in the previous 12 months. What is the Definition of a Residential Mortgage Loan? For SAFE Act purposes, a residential mortgage loan is defined as financing (other than temporary) that is secured by a 1-4 family dwelling or mobile home. The NMLSR is not currently operational and the exact date of implementation is not know. The banking agencies will publish notice when the registry is available; at that time, covered employees will have 180 days to register. In connection with the registration, MLOs will need to provide: fingerprints for an FBI criminal history background check personal history and experience authorization to the NMLSR to obtain information related to any administrative, civil, or criminal findings by any governmental jurisdiction 4

5 [ Issue One 2010 ] Risk-Based Pricing Notices and The Fair Credit Reporting Act The FACT Act amended the Fair Credit Reporting Act (FCRA) in 2003, and now, seven years later, we have the changes that implement the risk-based pricing (RBP) provisions. Risk-based pricing refers to the practice of using a consumer s credit report, which reflects his or her risk of nonpayment, in determining or adjusting the price and other terms of credit offered or extended to a particular consumer. Many creditors offer more favorable terms to consumers with better credit histories. The final rules would apply, with certain exceptions, to all creditors that engage in risk-based pricing. Under these rules, a risk-based pricing notice would generally be provided to the consumer after the terms of credit have been set, but before the consumer becomes contractually obligated on the credit transaction. The purpose of the notice is to alert consumers to the existence of negative information on their consumer report so that the consumer can check their consumer report for accuracy and correct any inaccurate information. Generally, the final rules require a creditor to provide a consumer with a risk-based pricing notice when, based in whole or in part on a consumer s credit report, the creditor provides credit to the consumer on material terms that are materially less favorable than the most favorable terms it provides to a substantial portion of its other consumers. Although requirements are not scheduled to take effect until January 1, 2011, the final rules include considerations that are prompting banks to begin their compliance due diligence now. Implementation methods and processes are outlined as options in the final rules that direct the identification of those customers who should be provided with a RBP notice. Not only do the final rules include model notices, but also exceptions and other information. A creditor must furnish a RBP notice when the following situations exist: When the creditor uses a consumer credit report in relation to a consumer credit application, AND Whether based in whole, or in part, on the consumer credit report, the creditor provides credit to the consumer on material terms that are materially less favorable than terms offered to a substantial proportion of consumers by the creditor, OR When account reviews of credit already extended to a consumer are performed, based in whole or in part on a consumer credit report, where the result is an increase to the annual percentage rate (APR). (Continued on page 6) 5

6 [ Plante & Moran regulatory compliance Advisor ] Risk-Based Pricing Notices and The Fair Credit Reporting Act (Continued from page 5) Material terms include: The annual percentage rate for credit that has an APR, For credit that does not have an APR, the financial term that varies and that has the most significant financial impact on consumers, such as a required deposit. For credit cards, the APR applicable to purchases. Factors that come into play in the definition of materially less favorable include the type of credit product, the term of the credit, and the difference in the terms of credit as it varies between two consumers. Although there is no definitive definition for substantial proportion, the final rules indicate it may or may not represent a majority. The final rules include a variety of methods to determine if a RBP notice is required to be given to consumers; however, a creditor must use the same alternative method to evaluate all consumers for the same type of credit product. Following is a brief discussion of the available methods: Direct Comparison Method Comparing the terms offered to one consumer to others for a specific type of credit product where the consumers are similarly situated. Credit Score Proxy Method Creditor analyzes its activities and determines a cutoff score at which risk pricing notices are appropriate. The cutoff score must be recalculated at least every two years. Tiered Pricing Method Creditors who assign pricing tiers to a consumer based in whole, or in part, on their consumer credit report may provide a risk-based pricing notice to each consumer who is not assigned to the top pricing tier or tiers. The number of tiers of consumers to whom the notice is required to be given depends upon the total number of tiers. Credit Card Offers With Multiple Rates Applicants who respond to multiple-rate offers for credit cards and, based on credit report, receive an APR that is higher than the lowest rate offered in the promotion, must receive a RBP notice. There are required elements to the content of the notice. The final rules include model RBP notices covering the following circumstances: Complying with the general risk-based pricing notice requirements Risk-based pricing notices given in connection with an account review Credit score disclosure exception for loans secured by oneto-four units of residential real property Credit score disclosure exception for loans not secured by residential real property Credit score disclosure exception where a credit score was not available Where a credit transaction may involve two or more consumers, a RBP notice must be sent to each consumer, except if they share the same address and the notice is addressed to all of the consumers at that address. RBP notices must be delivered on a timely basis. For closed-end credit, a RBP notice must be provided prior to the consummation of the credit transaction. For open-end credit, a RBP notice is required before the first transaction is made. For account reviews, the notice is required at the time the decision to increase an APR is communicated to the consumer, or if no notice of increase is provided before the date of the change, a RBP notice must be provided no later than five days after the change. Other provisions for auto leasing and instant purchase credit are included in the final rule. As part of the final rules to implement the RBP notice, a series of exceptions are described and defined where the notice is not required, even though risk-based pricing is used. Exceptions apply when: A consumer applies for and receives credit under the specific terms for which they applied. A consumer receives a notice of adverse action notice under section 615(a) of the FCRA. A creditor may provide the consumer with a notice containing the credit score disclosure along with certain additional information that provides context for the credit score disclosure. This applies to a credit that is or will be secured by a 1-4 units of residential real property. The additional information is outlined in the Act. A credit offer is part of a prescreened solicitation. Many banks currently use consumer reporting agencies to provide the credit score disclosure notice for residential real property loan applicants. It is anticipated these third-party providers will be making changes in the current disclosure formats to meet the additional requirements for exceptions to the RBP notice in the near future. This will allow creditors to use the credit score disclosure to meet the RBP notice stipulations. Banks are encouraged to contact their providers regarding such changes. In the case of credit applications being accepted or originated by outside parties, the bank is still responsible for monitoring the issuance of RBP notices. Originators of credit obligations must provide the RBP notice even if they immediately assign the credit agreement to another party and are not the source of funding. As with all lending requirements, creditors should have comprehensive and effective procedures for training and testing in place to monitor consistency and mitigate compliance risk. 6

7 [ Issue One 2010 ] FFIEC Releases New IT Exam Handbook Addressing Retail Payment Systems The Federal Financial Institutions Examination Council (FFIEC) issued the Retail Payment Systems Handbook on February 25, This updated guidance for examiners, financial institutions, and technology service providers more completely addresses the risks associated with retail payment systems. This handbook is part of the FFIEC Information Technology Examination Handbook series and updates the 2004 version that provided guidance on the risks and risk-management practices applicable to financial institutions retail payment systems activities (including checks, electronic payments related to credit cards and debit cards, and ACH transactions). This handbook provides a more in-depth discussion of the increased risks posed by merchant card processing and ACH activities and addresses the risk management tools that financial institutions can use to mitigate them. There is also a brief discussion on emerging technologies in retail payment systems. The booklet includes information on remotely created checks and electronically created payment orders, both of which are being used more frequently as payment devices. Lastly, the booklet addresses remote deposit capture and provides examination procedures for use in conjunction with the FFIEC guidance, Risk Management of Remote Deposit Capture (January 14, 2009). Financial institutions accept, collect, and process a variety of payment instruments and participate in clearing and settlement systems. In some cases, financial institutions perform all of these tasks. Independent third parties are increasingly involved in this process, introducing new risks that affect the security of financial institutions. Financial institutions, acting either in consortiums or independently, remain the core providers to businesses and consumers for most retail payment instruments and services. A number of new electronic payment instruments have recently emerged. Electronic payment systems offer efficiency gains by allowing for rapid and convenient transmission of payment information among system participants. However, the emergence of a new payment mechanism can also enable the rapid proliferation of fraud, money laundering, and operational disruption if data is compromised. Another trend associated with emerging payments is the increased participation of non-bank third parties in retail payment systems and a lengthened transaction chain, which may increase the risk in payment processes. Management of retail payments risk is increasingly difficult and requires diligent operational, credit, liquidity, and compliance risk oversight. A number of references are made in the new handbook to other IT Handbook booklets. There are also references to FFIEC guidance for Bank Secrecy Act examinations that are relevant to retail payment systems and for Check 21. Retail Payments Retail payments usually involve transactions between two consumers, between consumers and businesses, or between two businesses. Wholesale payments are typically made between businesses. Although there is no definitive division between retail and wholesale payments, retail payment systems generally have higher transaction volumes and lower average dollar values than wholesale payment systems. Retail payments may involve the use of various retail payment instruments or access devices (e.g., checks, ACH, card, phones, etc.) and include: Consumer purchases of goods and services Consumer bill payment Person-to-person payments (P2P payments) Account-to-account payments (A2A payments) Cash withdrawals and advances There are a variety of retail payment clearing and settlement systems. These include check clearing systems, ACH networks, ATM networks, and bankcard networks. Check clearing systems are now mostly electronic versus paper-based thanks to Check 21. ACH payments also have grown significantly as consumers use more direct bill payments. Retail firms have also employed checkto-ach conversion processes to obtain the efficiencies of electronic processing, reducing the number of checks that flow through the payment system. Internet-based bill payment systems are transaction origination platforms that allow customers to initiate bill payments through existing payment systems. Debit and credit cards, particularly signature and PIN debit, have driven much of the growth in electronic payments. Retail payments often move through multiple channels, which results in data being processed and stored on multiple systems that are typically outside of the direct control of the customer s financial institution. There are two primary challenges for financial institutions in managing these complex payment systems. First, the lack of congruity that often characterizes these systems and the associated lack of optimal data protocols may result in data integrity issues. Second, the complexity of systems increases the difficulty of the management of data security and system availability. Systems Risk Management In managing the overall risks in the financial institution, the nature and complexity of retail payments and settlement systems need to be considered. Participation in retail payment systems may expose financial institutions to credit, liquidity, and operational risk, particularly during settlement activities. In addition, a financial institution s credit, liquidity, and operational risks may be interdependent with payment system operators and third parties. Risk profiles vary significantly based on the size and complexity of the financial institution s retail payment system products and services, IT infrastructure, and dependence on third parties. All financial institutions should maintain an effective internal control environment commensurate with the level of retail payment products and services offered. Effective internal controls should (Continued on page 8) 7

8 [ Plante & Moran regulatory compliance Advisor ] FFIEC Releases New IT Exam Handbook Addressing Retail Payment Systems (Continued from page 7) include financial, accounting, technical, procedural, and administrative controls necessary to minimize risks in the retail payment transaction, clearing, and settlement processes. These measures reduce operational and credit risks, ensure individual transactions are valid, and mitigate processing and other errors. Effective controls also ensure supporting IT and network infrastructure promote retail payment transaction integrity, confidentiality, and availability. Financial institutions engaging in retail payment system services must be prepared to work with the risks inherent in the activity. Financial institutions engaged in retail payment systems should establish an appropriate risk management process that identifies, measures, monitors, and limits risks. Management and the board should manage and mitigate the identified risks through effective internal and external audit, physical and logical information security, business continuity planning, vendor management, operational controls, and legal measures. Examination Objectives and Procedures While the IT Examination Handbook is written for bank examiners, the federal banking regulators make this information available publicly. In developing your procedures and evaluating the control environment, the handbook will be an invaluable resource. The handbook identifies procedures as Tier I and Tier II procedures. The primary objective of Tier I procedures is to evaluate the effectiveness of the internal controls and risk management processes implemented by the financial institution or the technology service provider. Expanded procedures are available as Tier II procedures if the risk profile or organization s complexity requires additional information to establish comprehensive and accurate examination conclusions. (Continued on page 9) Risk Management Activities Management and the board of directors should ensure that an effective internal audit function for the financial institution s payment systems is in place. The audit program should test the quality of retail payment systems internal controls and compliance with laws, regulations, management policies, procedures, and limits. Audit coverage should be risk-focused and should cover all retail payment systems including third-party relationships. Special attention should be given to new retail payment technologies and products. Banks should implement the appropriate controls to ensure retail payment system transactions are processed, cleared, and settled in an accurate, timely, and reliable manner. Security risk assessments should consider physical and logical security controls for the origination, approval, transmission, and storage of retail payment system transactions. Risk assessments should include service providers, third-party originators, and external networks that process, store, or transport customer data. Financial institutions and their technology service providers (TSPs) should develop, implement, and test appropriate disaster recovery and business continuity plans (BCP) capable of maintaining acceptable retail payment-related customer service levels. For financial institutions and service providers with complex retail payment operations, business continuity plans should enable restoration of service within timeframes that are reasonable for internal business units as well as other dependent financial institutions and counterparties. Banks are responsible for establishing and maintaining effective vendor and third-party management programs. In connection with this responsibility, management must understand the complex nature of arrangements with outside parties and ensure adequate due diligence for the engagement of the relationships and ongoing monitoring. 8

9 [ Issue One 2010 ] FFIEC Releases New IT Exam Handbook Addressing Retail Payment Systems (Continued from page 8) Tier I procedures include: Assess the level of risk in the retail payment systems function Establish the scope and objectives of the examination of the retail payment systems function Assess the quality of oversight and support provided by the board of directors and management Assess the quality of policies, procedures, and limits supporting retail payment services Assess the quality of management information systems and reports used to manage retail payment services Assess the quality of risk management and support for bankcard issuance and acquiring (merchant processing) activity Assess the quality of risk management and support for EFT/ POS processing activity Assess the quality of risk management and support for ACH processing activity Assess the quality and risk management and support for electronic banking related payment transaction processing Assess the quality of risk management and support for checks Assess the quality of risk management of new and emerging technology risks Tier II procedures provide additional validation steps to verify the effectiveness of a financial institution s internal control processes over ACH, EFT/POS network, check item, electronic banking related retail payments, and bankcard processing, clearance, and settlement. Tier II procedures address: EFT/POS and Bankcard agreements and contracts Personal identification numbers (PINs) Information security Card issuance procedures Business continuity planning EFT/POS and Bankcard accounting and transaction processing EFT/POS operational controls ACH, ODFI and RDFI responsibilities ACH accounting and transaction processing ACH funding and credit Web and telephone-initiated ACH transactions ACH contingency plans Check 21 procedures Remote deposit capture risk management Vendor management An electronic version of the Retail Payment Systems Booklet, as well as the entire FFIEC IT Examination Handbook Series, is available online at it_01.html. 9

10 [ Plante & Moran Regulatory compliance Advisor ] Illinois Locations Chicago FAX Northwest Chicago FAX Michigan Locations Ann Arbor FAX Auburn Hills FAX Detroit East Lansing FAX Flint FAX Grand Rapids FAX Kalamazoo FAX Macomb FAX St. Joseph FAX Southfield FAX Traverse City FAX Ohio Locations Cincinnati FAX Cleveland FAX Columbus FAX Toledo FAX This publication is distributed with the understanding that Plante & Moran, PLLC is not rendering legal, accounting, or other professional advice or opinions on specific facts or matters and, accordingly, assumes no liability whatsoever in connection with its use. Forward your comments, change of address, or additions to our mailing list to Theresa Zimmerman at theresa.zimmerman@plantemoran.com.