AMLA RDC & ACH BEST PRACTICES TRAINING

AMLARDC & ACH BEST PRACTICESTRAINING June 23, 2010 Conducted by Michelle Hemerley Senior Vice President, Kenney Bank & Trust

OVERVIEW • Definitions of RDC, RCC, ACH & Third Party • Risk and Best Practices for RDC, RCC, ACH & Third Party Accounts • Unfair and Deceptive Acts or Practices (UDAP) • OFAC & Reporting Suspicious Activity • Best Practices Checklists • Questions

Definitions

Remote Deposit Capture (RDC) • Remote Deposit Capture, in its most simple terms, is a service which allows a user to scan checks and transmit the scanned images to a bank for posting and clearing. • The basic requirements for an RDC service currently include a PC, an internet connection, a check scanner and a service provider that offers RDC services. • Checks received at a business or bank location can be scanned to create a digital deposit. • This digital deposit is then transmitted (usually over an encrypted internet connection) to the RDC bank or service provider who then accepts the deposit, posts the deposit to the business account and assigns availability based upon the availability schedule.

Remote Deposit Capture (RDC) • “The most important development the (U.S.) banking industry has seen in years” • Benefits include convenience, better deposit availability and reduced cost, risk and volume of paper associated with physically mailing or depositing checks • Not all RDC solutions are the same. Additional functionality such as Intelligent Character & Document Recognition, data management through business rules, the ability to feed internal systems, intelligent clearing capabilities and many others can further add value to the business case

Remotely Created Checks (RCC) • "Remotely created checks" typically are created when the holder of a checking account authorizes a payee to draw a check on that account but does not actually sign the check. • The check is authorized remotely by telephone or on-line. • In place of the account-holder's signature, the remotely-created check generally bears a statement that the customer authorized the check or bears the customer's printed or typed name.

Remotely Created Checks (RCC) • Remotely Created Checks are being used more often because they have up to 40 characters in the notes section to explain the transaction (as opposed to only 12 characters for ACH transactions) • Although remotely created checks are a useful payment device for consumers and vendors, they have also become vulnerable to fraud because they do not bear a signature or other verifiable authorization.

Automated Clearing House (ACH) • The Automated Clearing House Network is a processing and delivery system that provides for the distribution and settlement of electronic credits and debits among financial institutions. • The ACH Network was developed in response to the huge growth in check payments and provides an efficient, electronic alternative to paper checks. • The Network is governed by the National Automated Clearing House Association (NACHA) Operating rules, commonly referred to as the ACH Rules.

Automated Clearing House (ACH) • The ACH Network operates as a batch processing, value-dated, electronic funds transfer between an originating and a receiving bank. • Transactions received by the financial institution during the day are stored and processed later in a batch mode. Instead of sending each payment individually, ACH transactions are gathered and sorted by destination for transmission during a set time period. • This provides for faster processing than paper checks and allows all necessary transaction information to be transmitted electronically. • The ACH Network is used for all kinds of fund transfer transactions, including direct deposit of paychecks and monthly debits for routine payments such as mortgage payments.

Automated Clearing House (ACH) • An ACH transaction is authorized by an individual or organization (Receiver), to be initiated by another individual or organization (Originator) • The Originator then provides to an Originating Depository Financial Institution (ODFI) or its third party processor a file containing information on the ACH transaction formatted per NACHA rules • The ODFI or its third party processor then transmits the information in a file to an operator (ACH Operator) • The file is made up of a batch of ACH transactions. Each transaction is either an electronic debit or credit formatted per NACHA rules

Automated Clearing House (ACH) • The ACH Operator then sorts the transactions and transmits to a Receiving Depository Financial Institution (RDFI) or its third party processor • The RDFI then posts the ACH transaction to the Receiver’s account • A return notification is sent if there are insufficient funds in the account • There are new rules for any International ACH transaction (IAT)

Automated Clearing House (ACH) • Each ACH transaction is required to be identified by a Standard Entry Class (SEC) Code - a three character code that identifies the payment type. • SEC Codes are divided into various types: consumer, corporate, both consumer and non-consumer accounts, and other. • In addition to the SEC Code, an Originator must include a Transaction Code - a two-digit code that determines whether the entry is a debit or credit to a DDA account, savings account, or general ledger account, or whether the entry is a credit to a loan account.

Third Party Payment Processor • Non-bank or third-party payment processors are bank customers that provide payment-processing services to merchants and other business entities. • These merchant transactions include credit card payments, ACH, Remotely Created Checks and debit and stored value cards transactions. • With the expansion of the Internet, processors now service a variety of merchant accounts including conventional retail and internet based establishments.

Risks and Best Practices for • RDC, RCC and ACH • Accounts

FFIEC RDC Guidance • Risk management, governance and oversight should be based on the size and complexity of the Bank & relative scale and impact of RDC activities • RDC Risk Assessment should include: • Risks – Strategic, Credit, Compliance/BSA, Operational, Transaction, Legal and Reputation Risks • Security and confidentiality risks as well as vulnerability and business continuity risks • Risk tolerance levels

RDC / RCC / ACH Risks • Bank has two primary responsibilities: 1) Complete Due diligence & underwriting on customer - Consider customer’s business activities, geographic location and customer base 2) Monitor for high levels of unauthorized returns or suspicious or unusual patterns of activity • Ensure the Bank maintains appropriate policies, procedures and controls relative to risk • Train the RDC customer

RDC / RCC / ACH Risks • Create customer parameters which include: • A list of acceptable industries • Standardized underwriting criteria (i.e., credit history, financial statements, ownership structure, types of business, google, etc.) • Set maximums for large dollar items • Obtain expected account activity such as the anticipated number, dollar volume and type of transaction • Monitor the returns and any changes in the volume or dollar amounts of the transactions

RDC / RCC / ACH Risks • Visit the high-risk RDC,RCC or ACH customers and obtain enhanced due diligence • Contracts should include: • Requirements to retain, protect, and ultimately destroy original documents • Requirements for properly securing equipment to prevent inappropriate use and effective equipment security controls (i.e., passwords, dual control access) • Event of counterfeit documents or double deposits • Additional laws such as Unlawful Internet Gambling Enforcement Act (UIGEA)

Third-party Payment Processors • Risk – Money laundering, identity theft, fraud, & reputational risks • Know your customer’s customer, understand the nature and source of transactions as well as their target clientele (i.e., review websites, promotional materials) • Determine if the processor re-sells services to a 3rd party who may be referred to as an agent or Independent Sales Organization (ISO) • Review the processor’s policies, procedures and processes to determine the adequacy of its due diligence standards

Third-party Payment Processors • Identify the processor’s major customers • Review corporate documentation including independent reporting services and documentation on principal owners • Visit the processor’s business operations center • The bank should have a good understanding of: • Merchant base and activities • Average number and dollar volume as well as number of transactions • Account history including rates of return and anticipated rates of return

Third Party Payment Processor • Google and read the information – customer indicted • Obtain written agreements between the processor and their customers • Sites dedicated to complaints about company • Be sure to train the third party on why you need enhanced due diligence information • Obtain examples of due diligence third party obtains • Just because Payroll doesn’t mean they are clean

Unfair and Deceptive • Acts or Practices • (UDAP)

UDAP – “Unfairness” • Causes “substantial” consumer injury • Can be substantial for few or slight for many • Normally monetary, not emotional harm • Is not outweighed by consumer or competitive market benefits • Could have been reasonably avoided

UDAP – “Deceptive” • Representation, omission or practice that: • Is likely to mislead a consumer acting reasonably • Is material in impacting consumer decisions and behavior • A statement can be literally true but still deceptive • Hard to identify

UDAP – Recent Cases • Wachovia – OCC fine 5/08 - $144 million • 3rd party actions by telemarketers & payment processors involving remotely created checks • Lesson: You are responsible for what’s being done by 3rd party relationships • CompuCredit & 3 Banks – FDIC fine 6/08 - $114 million, $2.4 million Civil money penalties • Misleading credit card solicitations • $300 limit / $185 fee – targeting people with bad credit

UDAP – Recent Cases & Lessons • Providian – OCC fine 6/00 - $300+ million in restitution and fees • Hidden fees, omission of terms, late disclosures • Didn’t know rate until transfer balances – 3% to exit • Lessons • Be sure what they offer is what people are getting • Potential issue if you or 3rd parties are targeting elderly, minorities, non-english speaking, bad credit • Review complaints – document oral complaints

OFAC & Reporting • Suspicious Activity

Office of Foreign Asset Control • Run all signers through OFAC • Run all owners and high-risk customers through Worldcheck (includes OFAC), including owners of LLCs • Perform OFAC Scrub regularly • The ODFI is responsible for verifying the Originator is not a blocked party and the RDFI is responsible for verifying the receiver is not a blocked party. They rely on each other.

Reporting Suspicious Activity • If suspicious activity is noted, complete Unusual Activity Form and send to BSA/AML Department immediately • Be sure to explain “Who”, “What”, “When”, “Where”, “How” and “Why” you are suspicious • Keep CONFIDENTIAL – never discuss with customer

Enhanced Due Diligence • Checklists

Questions? • Agenda items will follow the • Q & A Session

Regulatory Update FinCEN • April 16, 2010: FinCEN Encourages Financial Institutions to Consider Benefits of BSA E-Filing. Fincen developed and released a brochure explaining the benefits of e-filing. Found on their website. • April 27, 2010: FinCEN Advisory-2010-A004: Filing Suspicious Activity Reports Regarding FHA Home Equity Conversion Mortgage Fraud Schemes – This scheme targets the elderly and a form of reverse mortgages under FHAs Home Equity conversion program. Advisory contains examples of common fraud schemes and potential "red flags" for fraudulent activity. (Continued)

Regulatory Update FinCEN • Suggests key words for financial institutions to use when completing SARsinvolving fraud related to the HECM program. FinCEN is requesting that you enter specific language in your SAR if you note this kind of activity within your organization so they may readily identify these schemes. You do not have to be a provider of this product to see activity as you might have a customer that has an elderly parent and they deposit funds into their bank account with your FI and never disburse the money to the elderly parent.

Regulatory Update FinCEN • April 29, 2010: FFIEC 2010 BSA/AML Examination Manual Interagency Release. Significant Updates are noted in the table of contents as “2010.” Most recent MSB List As of May 2010 on FinCEN site • June 17, 2010: FinCEN released its first analysis of suspicious activity reports containing information about potential foreclosure rescue scams. The report, Loan Modification and Foreclosure Rescue Scams – Evolving Trends and Patterns in Bank Secrecy Act Reporting, involved an analysis of more than 3,500 SARs filed from 2004 through 2009. • (Continued)

Regulatory Update FinCEN • A majority, 3,000, were filed last year. Also FinCEN provided updated guidance to the financial industry concerning new scam techniques that financial professionals should watch for and report. • June 21, 2010: Notice of Proposed Rulemaking: Amendment to the Bank Secrecy Act Regulations applicable to MSBs with regard to stored value or prepaid access. The Prepaid Access Rule Proposes Greater Transparency to Help Curb Money Laundering and Terrorist Financing and to fill in regulatory gaps and areas of vulnerability with a more comprehensive regulatory framework. • (Continued)

Regulatory Update FinCEN • Major features of the proposal are: • Renaming “stored value” as “prepaid access” without intending to broaden or narrow the term and defining the term to allow for future changes in technology and prepaid devices; • Deleting the terms “issuer” and “redeemer” of stored value and adding the terms "provider" and "seller";

Regulatory Update FinCEN • Continued----Major features of the proposal are: • Placing registration requirements on providers of prepaid access and suspicious activity reporting, customer information recordkeeping, and new transactional recordkeeping requirements on both providers and sellers of prepaid access; and • Exempting certain categories of prepaid access products and services posing lower risks of money laundering and terrorist financing from certain requirements.

Enforcement / Other Regulatory Actions • June 3, 2010: FinCEN: CMP of $1 Million against Pamrapo Savings Bank, S.L.A., of Bayonne, N.J. for violating requirements under the Bank Secrecy Act. • May 4, 2010: FinCEN and FDIC: $25,000 CMP against Eurobank, San Juan, Puerto Rico. FinCEN and FDIC allege Eurobank failed to implement an adequate anti-money laundering program and monitor accounts for suspicious activity. • June 3, 2010- OFAC Penalties & Enforcement Actions - 2 actions: $16,366.00 total.

OFAC • OFAC Release March 1, 2010: • 2009 OFAC Annual Report-Assets in the United States of Terrorist • Countries and International Terrorism Program Designees

Reports/Fact Sheets • 314(a) Facts and Figures (06/15/2010) • Law Enforcement Information Sharing with the Financial Industry (06/1/2010) • The SAR Activity Review-By the Numbers: January 2010 • SAR Activity Review Trends and Tips-Issue 17 Casino and Gaming Industry –May 2010 • 314a Point of Contact Info Change-April 8, 2010

MEETING ADJOURNED • Thank you for attending and participating • with us today. • Visit us at www.theamla.com

AMLA RDC & ACH BEST PRACTICES TRAINING