Audit Link Focus Group

1. Audit Link Focus Group February 20, 2009

2. Agenda • Introduction and Formalities • AS Level 1 • Red Flag Questions for Experian • Other Red Flags and CU*BASE • Common upfront contact and daily work findings by Leah Sutherby and Jim Vilker • What’s next for Audit Link

3. Other Red Flag Questions • Handling address discrepancies • Due diligence on address discrepancies • Other questions for our Experian partners • Questions regarding reporting of credit bureau data promulgated by a recent League event http://www.cuanswers.com/kitchen/fact.php

4. CU*Base and Red Flag Red flags checked through AS Level 1 • Address discrepancy by CRA (also on CB report) • Fraud or active duty alert (also on CB report) • Personal information is associated with known fraudulent activity • Personal information is inconsistent when compared to external sources • Personal information provided is inconsistent including phone, SSN, address, drivers license, DOB • Address is fictitious, a mail drop, or prison In the Spring of 09 all of the above items will be fully integrated in CU*BASE and become audited data on the member record

5. Other Red Flags • Address changes • New feature which warns staff and automatically notifies member when address has been changed. Teller, inquiry, card ordering. • Returned member statements and transactions are occurring • Run a report on Mail Group 7 and review accounts with recent transactions. Contact member and freeze account • Second tier dormancy monitoring and training

6. Other Red Flags • Anomalous use of account • Account is used after an lengthy inactive period • Review dormancy configuration and train staff on dormancy review • Member fails to make the first payment • Sort by first payment date in collections and train staff on potential red flag activity • Majority of available credit is used for cash advances • Query report on cash advance activity

7. Other Red Flags Other Red Flags (as defined in regulation) • An employee has downloaded an unusually large amount of customer data • Currently with a programmer • The address, SSN, and home or cell phone number provided is the same as that submitted by other persons opening an account or other customers. • Requested by a credit union. Currently in review • The financial institution or creditor detects attempts to access a customer's account by unauthorized persons • MNMISC option 10 review

8. Red Flags in Total Of the total 31 potential Red Flags • 16 of them – GOLD has tools to either control the event or allow you to monitor for activity • 15 - are strictly internal procedures which have nothing to do with the use of CU*BASE but can be tracked through the use of the tracking system

9. RMG “Risk Management Generator”A new tool for evaluating third party relationships WHY? • NCUA says To expand service and product offerings, credit unions increasingly outsource functions and programs through collaboration with third parties. Developing sound third party relationships and alliances can assist credit unions in meeting their strategic objectives and enable them to: • Provide access to products and services through expanded delivery channels. • Offer more cost-effective products and services; and • Manage programs that would not be feasible without external expertise.

10. RMG “Risk Management Generator”A new tool for evaluating third party relationships WHEN DOES IT APPLY • Involves a new financial service activity • Materially affects revenues and expenses • Involves member data • Involves marketing of CU products by a third party • Involves subprime lending or card payment transactions • Poses risk that could significantly affect earnings or capital

11. RMG “Risk Management Generator”A new tool for evaluating third party relationships WHAT DOES IT COVER? • Core data processing • Mortgage servicing and underwriting • Internet banking • Indirect lending • Bill payment • Call centers • Network maintenance

12. RMG “Risk Management GeneratorA new tool for evaluating third party relationships HOW? INTRODUCING THE RMG http://rmg.cuanswers.com/users/login

13. Audit Link Update • Findings of up front contacts • Findings from daily audit work • Audit Link Advisor site • Software development related to audit link • Increasing capacity • New team members • Streamlining processes and changing software • Clients Status • Johns comments on regulatory environment

14. Findings of First Contacts • Wire transfer tracking • Regulation E • Statement generation • Dispute resolution • Regulation D • New report for the spring release • Dormancy monitoring • TIS • Fee disclosures and ANR configurations • ECOA • Employee and data center security

15. CTR’s & DBA’s • Only 1 section A is needed • FINCEN will accept CTR’s with 2 section A’s • Sole proprietorships and DBA

16. Name of legal entity • DBA name • Entity’s EIN • Entity’s address

17. Double Check every CTR or SAR • Most mistakes made on CTR’s and SAR’s could be avoided by a second review of the form • When a mistake has been made… • Check the Amends Prior Report box • Staple a copy of the original report to amendment

18. BSA Errors • When an employee deletes a BSA tracker, a description of the incident still needs to be entered • When an error has been made it needs to reversed instead of creating more cash transactions • After reviewing BSA activity put findings in the Audit Tracker

19. Dormant Accounts • Work dormant accounts on a regular basis, otherwise the Activity on Dormant Accounts report is inaccurate • Do not delete accts from dormancy monitoring due to fees • Review of priority on configuration when adding new products • ACH postings are considered activity • Use the Audit Link Run Sheet to save time when working dormancy

20. Non-Member Transactions • How can OFAC be run on a non-member? • Enter non-member information into MNUPDA, #8 (Update Non-Member Information) • Use F15 (Verify Name) to run OFAC after Non-Member file has been created • Run name at www.instantofac.com to compare a name to the OFAC SDN list or use the web based Experian AS 1 from the “Network” button on GOLD

21. Withdrawn Loan Applications • Configure the withdrawn by member codes to memo •  Make sure the configuration is set to do not prompt for denial notice

22. Use the withdrawn by member code on application • Let the application stay in pending status until automatically removed

23. Employee Accounts • Configure Employee Type (MNCNFC #2) • Allow posting only • High Risk Accounts • Employee Account Security (MNMGMT #1) • Update Account Security • Enter each of employee’s own accounts • Allow account inquiry only • Update special security

24. Audit Link on the Web • Audit Link Advisor site http://advisor.cuanswers.com/

25. Software Developments • AS Level 1 incorporated into the account opening process ps#22083 Status—In next release • Address change warning messages and audit tracker write-out ps#24335 Status—In Process • New collector screen sort to monitor for first payment skips ps#22426 Status—In next release • Change in credit reporting to add the Address Indicator field which confirms the verification of an address after a discrepancy has been received ps# 24551 Status— Awaiting specifications • Automated scan for FinCen ps#20312 Status—Waiting for programming resources

26. Software Developments • Running wire transfers through OFAC at the time of creation. Status—In fall release • New BSA file structure to monitor for FSCC and Xtend shared branching. ps#24190 Status—In Process • Update to BSA report ps#24092 Status—In next release • Running recipient of a corporate craft ps#24553 Status— Awaiting approval • New Reg D statistics report ps#23555 Status—In next release • NCUA share insurance analysis report ps#24015 Status—In process • Enhanced Due Diligence ps#23964 Status—In process

27. Business Status • Increasing capacity • New team members • John Yoemans - Consultant • Marisa Bailey – Audit Associate • Streamlining processes and changing software • Portal under development

28. Business Status • 18 upfront contacts completed • 15 on daily monitoring • 6 additional clients reviewing contracts • 6 additional credit unions expressed interest • Expecting 35 to 40 total partners by year end

29. From the Desks Of • John Yoemans “The regulatory environment” • Jim Vilker “Whats next” • Who’s next • Defining the model • Expanding on ad hoc and consulting services