Increasingly community banks are turning to

Transcription

1 A system of ACH risk-management valves can help banks bypass the big loss By Jeanette A. Fox and Cary Whaley Increasingly community banks are turning to payments, specifically Automated Clearing House (ACH) origination, as a service to their corporate customers and through their home banking platforms. But while ACH origination can be a valuable and profitable service offering, it also exposes the bank to risks that can result in big losses. 70 IndependentBanker

2 IndependentBanker 71

3 The following case study illustrates how one real-life community bank (we ll call it ABC Bank to protect its anonymity) faced a potentially business-ending situation due to a lack of riskmitigation procedures or a failure to abide by them. What Happened ABC Bank had an agreement to be the Originating Depository Financial Institution (ODFI) for an Internet-based payment processor (Processor A). cards, ACH debits (originated by ABC Bank) and checks or drafts. * In early- to mid-february 2006 there was a sharp rise in the number of Company A s ACH debits that consumers returned. * Shortly thereafter the Securities and Exchange Commission charged CompanyA.com with operating a Ponzi scheme (a fraudulent investment operation that pays abnormally high returns to investors out of money paid in by subsequent With investors unable to withdraw funds out of Processor A s system, many simply went to their card issuers and banks claiming the original transactions to fund their Processor A accounts were unauthorized. Processor A had been a customer of ABC Bank for quite a long time. However, a customer of Processor A brought ABC Bank to the brink of insolvency: * CompanyA.com, a customer of Processor A, operated a Web site as an autosurf high-yield investment. Investors transferred funds to CompanyA.com through Processor A. (Consumers viewed a specified number of Web-based advertisements and received payouts from CompanyA.com for their activity.) Investors funded their accounts at Processor A through banking payment instruments credit cards, debit investors, rather than from net revenues from a real business), and froze its assets including its Processor A account. * With investors unable to withdraw funds out of Processor A s system, many simply went to their card issuers and banks claiming the original transactions to fund their Processor A accounts were unauthorized. * Concurrently, the SEC succeeded, temporarily, in obtaining court orders that enjoined financial institutions from complying with payment systems rules and Federal banking regulations regarding the processing of chargebacks and returns. With the Lessons Learned A couple of years ago, a community bank engaged multiple third-party service providers bringing hundreds of primarily Web originators to the Automated Clearing House (ACH) Network. Within a few months, this Originating Depository Financial Institution (ODFI) became the No. 1 receiver of unauthorized returns in the ACH Network. Typical monthly volumes of unauthorized returns reached into the millions of dollars. Safety and soundness was of concern because this ODFI had less than $10 million in Tier 1 capital at the time. The ODFI received immediate attention from its regulator and a subsequent agreement was entered after the regulator identified unsafe and unsound banking practices related to the Bank s ACH and draft management programs as well as the bank s credit administration practices. As a result, the bank was required to perform several steps (some specific to ACH), including a risk-based audit approach, maintaining specified capital levels, and a written policy of asset/liability management. In addition, the ODFI was required to develop, implement and ensure adherence to a written risk management program. 72 IndependentBanker

4 Processor A account frozen, ABC Bank was faced with covering the return volume, which was greater than its capital. The result was twofold: (1) Because the item return value was above capital, the safety and soundless of ABC Bank was in question; And (2) there was a great deal of uncertainty and exposure for Receiving Depository Financial Institutions (RDFIs), which were required to re-credit their customers accounts, but whose ability to return the transactions was in doubt. The OCC guidance on ACH risk management is directly relevant to today s community banks. John Kline, president and CEO of Union Savings Bank Many factors in this episode are worthy of review. Some are related to the Internet-based nature of CompanyA.com s underlying business and of Processor A s proprietary stored value system. In the end, ODFIs were able to cover the amount of the returned ACH debits through Processor A s reserves. And RDFIs ultimately obtained relief when the court order enjoining payment system rules was amended, thus removing any doubt as to whether the NACHA Rules return provisions would remain in effect for these transactions. 74 IndependentBanker

5 Still, the velocity at which the problem developed not only demonstrates the importance of Know Your Customer principles and the best practices for ODFIs (discussed in this article), it also demonstrates the importance of knowing who the customer s customers are and that even an apparently good customer can cause a significant problem in a short amount of time. Processor A s Internet-based stored-value-transfer system enabled it to act as a principal to the transactions (Originator), rather than as a traditional third-party processor. Investors did not send money directly to CompanyA.com, but instead did so entirely through Processor A s proprietary system, from one Processor A account to another. This had several impacts on risk management. It shifted liability for the ACH debits from the underlying business,companya.com and its bank, to a processor: Processor A and Processor A s banks. Because processor A was the Originator of the transactions, the ODFIs would not have been able to identify and monitor forward and return transactions that were being conducted on behalf of CompanyA.com. RDFIs handling unauthorized debit claims also had the challenge of differentiating CompanyA.com transactions from all transactions handled by Processor A. In order to reduce the likelihood that another Processor-A-type situation would recur, NACHA recommends that ODFIs improve their risk-management controls. Evaluating, Mitigating Risk The following guidelines should be incorporated into any ACH risk-management strategy: Balance sales culture with risk management. ACH risk exposure should be measured, monitored and reported. Your daily settlement advices from the ACH Operator will itemize the dollar volume of ACH returns being charged to your account and provide insights regarding the need for further investigation of individual originators. Ensure account officers and credit administrators fully understand ACH origination credit risks, including the potential maximum credit exposure versus daily and multiday limits (and for consumer ACH debits, including the extended return window). Increase credit risk and credit policy awareness among operations staff while ensuring communication and accountability with credit administration, risk management and audit staff. Know Your Customer, Know the Rules. It is critical for ODFIs to know their customers, and in the origination of large numbers of ACH debit entries, it may be important to know the customer s customer. An ODFI must also manage debit entry origination risk. The potential consequences of breaching the warranties in NACHA s rules can be catastrophic for an ODFI, and the length of time an ODFI s warranties exist under state law means that the financial risk to an ODFI lives on long IndependentBanker 75

6 after the ODFI originates unauthorized entries. Become knowledgeable about the NACHA Operating Rules and include your responsibilities and liabilities for payments settling against your account. Ensure origination customers understand and fully comply with reasonable ACH riskmanagement requirements and the NACHA Operating Rules. Ensure that origination and processing agreements protect your institution and allow for prompt action in case requirements are not met. Scrutinize third-party processors and third-party senders on an ongoing basis: Make sure the party that actually obtains the funds from ACH debit entries originated through your institution has followed all of the rules. You may need to require your customer to disclose the terms and conditions under which it does business with its customers. Once again, credit worthiness checks are effective tools, and upstanding companies will be happy to assist and be scrutinized. ODFIs Should Monitor Returns. A significant number of ACH return items that relate to debits originated by one of your customers could indicate a serious situation developing. For example, a third party may process ACH debits for a year with relatively low return rates. But, a significant change in the ACH origination volume and, in particular, the return volume means that the ODFI needs to pay attention. 76 IndependentBanker

7 OCC Issues ACH Risk Guidance Last September, the Office of the Comptroller of the Currency released Automated Clearing House (ACH) risk management for national banks and examiners. Some highlights from the guidance are: Risk-Management Systems and Controls written policies and procedures; strong internal controls; risk-based audit program Reports to the Board of Directors the board of directors, or a committee thereof, should receive periodic reports that allow the board to determine whether ACH activities remain consistent within board-established parameters ACH Audits the depth and breadth of a bank s ACH audit program will depend on the volume and complexity of its ACH operations Assessments of Credit Risk, Compliance Risk and Transaction Risk applicable policies, procedures, and processes for its ACH activities, including those connected through third parties Originator Underwriting Standards formal underwriting standards and an approval policy for ACH originators Analysis of Creditworthiness and Establishing Exposure Limits analysis of originators creditworthiness and appropriate exposure limits Assessments of High Risk Activities, Third-Party Relationships, including the Direct Access Participant relationship a bank that engages in high-risk ACH activities should have strong systems to monitor and control risk All Risk Exposure Must Be Considered. ODFIs must understand and manage their exposure over the entire return window that is fundamental to the ACH Network. Many ODFIs set and manage daily exposure limits with their Originators, but few factor in exposure over the entire cycle in which a consumer ACH debit can be returned unpaid. The RDFI has a legal claim on funds obtained without authorization. Under ACH Network Rules, the RDFI may initiate an uncontestable return against the ODFI up to 60 days from settlement of the original transaction if its customer signs a written statement under penalty of perjury. Furthermore, because ODFIs warrant that all debit transactions are properly authorized and valid, they may be liable for entries for possibly 3 to 7 years depending on local and/or state law. Consider establishing a return reserve requirement for customers that originate certain types of ACH debits through your institution. Bad actors are likely to respond to such a requirement by taking their dishonest enterprises elsewhere. Proceed with caution in highrisk circumstances. Your institution is responsible for settling all ACH transactions that are originated using your IndependentBanker 77

8 routing and transit number. Use the Know Your Customer principle to guide the decision to hand your customer the keys to your institution s clearing account. In addition to performing due diligence prior to giving any customer direct access to an Operator, it is critically important to monitor the account activity of these customers on a regular basis. Fixing System Shortfalls NACHA, its members and the ACH Operators are implementing a comprehensive riskmanagement strategy addressing four categories: 1. Network entry requirements 2. Ongoing requirements 3. Enforcement 4. ACH Operator tools Each category is a complementary piece of the entire strategy, explains Elliot McEntee, NACHA s president and CEO. The goal of the strategy is to ensure high-quality ACH transactions and mitigate risk for financial institutions, businesses and consumers by minimizing unauthorized entries. In September 2006, NACHA, along with the two ACH Operators, sent a letter to the CEOs of all financial institutions in the United States, encouraging them to renew their commitment to ACH risk management and best practices in originating ACH payments. The letter closely resembled earlier guidance issued by the Office of the Comptroller of Currency (OCC) for national banks and examiners. (see sidebar, page 77). Other agencies are expected to follow the OCC s lead and issue similar guidance in the near future. John Kline, president and CEO of Union Savings Bank in Danbury, Conn., and former vice chair of NACHA, said, The OCC guidance on ACH risk management is directly relevant to today s community banks. Community banks no longer just receive ACH payments. Many now originate a wide variety of ACH-related products and services. The OCC guidance is an important reminder that community banks, too, need to conduct risk-management programs that are appropriate to their levels and complexity of ACH activities. Prudent risk-management practices allow financial institutions to take advantage of the opportunities afforded by today s ACH Network while still protecting their financial interests and reputations. John Buhrmaster, president of 1st National Bank of Scotia and vice-chairman of ICBA s Payments and Technology Committee adds, While payments processing can be a profit center for a community bank, banks must ensure they have the expertise to identify and effectively mitigate related risks. ib Jeanette A. Fox is director of Risk Management Services for NACHA. Cary Whaley is associate director, Payments Policy for ICBA IndependentBanker 79