Operational Means to Fraud Mitigation and BSA/AML Compliance

Transcription

1 Operational Means to Fraud Mitigation and BSA/AML Compliance Brad Johnson Director of Business Development Centrix Solutions Helen May SVP, Director of Operations Bank of Tampa

2 Cybercrime & Payments Fraud Account Takeover Realities Stolen credentials, not weakness of Online Banking Matter of when a business network is infected, not if Even strong security can be bypassed Significant losses & damaged reputations Attacks will continue to get worse There is no Silver-Bullet solution Centrix Solutions Inc. EastPay Information Interchange 2014

3 Cybercrime & Payments Fraud What is our biggest vulnerability or exposure point? ANSWER: People!!!! Centrix Solutions Inc. EastPay Information Interchange 2014

4 Centrix Solutions Inc. EastPay Information Interchange

5 Understanding Risk RISK Centrix Solutions Inc. EastPay Information Interchange 2014

6 WHERE ARE WE NOW? OCC Bulletin ( ) NACHA Risk Management & Assessment Rule (2010) FFIEC Guidance 2011 Authentication in an Internet Banking Environment NACHA ACH Security Framework Guidance 2013 Centrix Solutions Inc. EastPay Information Interchange

7 WHERE ARE WE NOW? Examiners look at the guidance as the barebones minimum Examiners are beginning to develop their own concept of what is acceptable. The FI must understand the intricacies of what is normal for a client Centrix Solutions Inc. EastPay Information Interchange

8 WHERE ARE WE NOW? Layered Security Commercially Reasonable policies, procedures and systems Customer Education Risk Assessments No single silver-bullet solution Centrix Solutions Inc. EastPay Information Interchange

9 Layered Security Program Layered security is characterized by the use of different controls in a transaction process weakness in one control is generally compensated for by the strength of a different control. Centrix Solutions Inc. EastPay Information Interchange

10 Layered Security Online Behavior Behavioral Analytics: Monitor the online banking session to determine if it is expected and legitimate behavior or suspicious behavior Does the online session deviate from predicted behavior Account access Online Managing accounts Monitoring Types of transaction activity Types and amounts of payments Click patterns Centrix Solutions Inc. EastPay Information Interchange

11 BSA/AML Compliance Transactional Behavior: Monitoring client behavior Does the client s behavior deviate from expected behavior ACH transfer activity Wire transfer activity Cash activity ATM activity Check activity Monetary instruments Centrix Solutions Inc. EastPay Information Interchange

12 ODFI Transaction Analysis The OCC bulletin describes how ODFI s can protect themselves and their customers Transactional Behavior Limits (File, Daily, Multi-day, Temporal) SEC Blocks Transaction Allowable Account Lists Monitoring Calendaring Unauthorized Returns Centrix Solutions Inc. EastPay Information Interchange

13 RDFI Transaction Analysis The FFIEC guidance defines POSITIVE PAY as an effective control that may be included in a layered security program Transaction Behavior Effective Controls Positive Pay Block/Filters Preauthorized Transaction Monitoring Centrix Solutions Inc. EastPay Information Interchange

14 ODFI Transaction Analysis The OCC bulletin describes how ODFI s can protect themselves and their customers Online / Transactional Behavior Limits (File, Daily, Multi-day, Temporal) SEC Blocks Transaction Allowable Account Lists Monitoring Calendaring Unauthorized Returns Reporting/Risk Assessments Centrix Solutions Inc. EastPay Information Interchange 2014

15 NACHA ACH Security Framework Guidance Implementation: 09/20/2013. Applied to 2014 audit cycle The Security Framework is aimed at protecting the integrity of ACH data throughout its lifecycle. Requiring the ODFI, Non-Consumer Originators, and 3 rd Party Service Providers to.. implement/update security policies, procedures and systems related to the processing and storage of entries Centrix Solutions Inc. EastPay Information Interchange

16 NACHA ACH Security Framework Guidance Implementation: 09/20/2013. Applied to 2014 audit cycle The Security Framework is aimed at protecting the integrity of ACH data throughout its lifecycle. Requiring an ODFI to use commercially reasonable methods to.. establish the identity of originators or 3 rd party sender. Centrix Solutions Inc. EastPay Information Interchange

17 NACHA ACH Security Framework Guidance Implementation: 09/20/2013. Applied to 2014 audit cycle The Security Framework is aimed at protecting the integrity of ACH data throughout its lifecycle. Requiring each ODFI and 3 rd Party Service provider to verify as part of the audit that.. it has it has the proper data security policies, procedures and systems required by the Rule Centrix Solutions Inc. EastPay Information Interchange

18 QUESTIONS! Centrix Solutions Inc. EastPay Information Interchange

19 Operational Means to Fraud Mitigation and BSA/AML Compliance Brad Johnson Director of Business Development Centrix Solutions Helen May SVP, Director of Operations Bank of Tampa