04/29/2013 MANAGING ACH RISK: BEST PRACTICES Presented by: Brent Siegel, Argos Risk, LLC Kelly Kiker, Bank Plus AGENDA  Introductions – Kelly Kiker – Brent Siegel  Managing ACH Risk –Best Practices – Policies – Procedures – Tools  What are the Risks? Where are the Risks? – Financial Health – Fraud – 3rd Parties – Business Practices  What are the Best Practices you can implement now – Assessment – Underwriting & Onboarding – Modeling – Tracking & Monitoring – Again  BankPlus Practices and Discussion WHAT ARE THE RISKS – WHERE ARE THE RISKS? Compliance Reputation Strategic RISK Operations Credit Transaction 1 04/29/2013 WHAT ARE THE RISKS? WHERE ARE THE RISKS?  Underwriting unsecured loans  ACH and RDC are recurring transactions – not a traditional credit  Apple to Oranges – risk reserves?  Depository/Credit Customer vs. ACH/RDC only  Are we sometimes asking the wrong people to make the underwriting decision?  Do we have the tools to risk rate and score the credit? WHAT ARE THE RISKS?  Poor Financial Health  Fraud, Account Takeover  3rd Party Senders  Originators Business Practices WHAT ARE THE RISKS? WHERE ARE THE RISKS?  Financial Health – Credit Worthiness – Business Health – Payment Practices  Tools – Policies and Procedures – Credit Reports – Financial Analysis – Account Review 2 04/29/2013 FINANCIAL HEALTH RISK BEST PRACTICES  Balanced Credit Reporting – There is no existing database of ACH/RDC Risk Metrics – There is no DNB or Experian for ACH and RDC  The information you have on depository customers is superior to external sources – BUT - That is not the point – The point is that you can combine external credit and business scoring with a process to look at ACH and RDC in a consistent way – AND you can monitor these relationships FINANCIAL HEALTH RISK BEST PRACTICES  Examine the credit data you have access to – Business Credit Scores – Payment History Scores  Standard Documents – Taxes, Financials, etc. erocS tiderC YEPPVVAPDPemaaeeromaoaysnrlyapccmtorsd steel uDooi Bensliniuyrnnestt teey ayPt Beo ogaRRusfeynee s m Ldccioen oofeTge rrneSasddlrtlsos sm ws Pays htlaeH ssenisuB THMRLLPCDSaicieohietmguwoifoacgehlrelrltsaleri ieunlCteIpysniniinro l tnedPegscng audi,eTn ysLBisrtgmtia u e rOdGsyneeif nesntf ,erote es rgse nsrdad p s hy ycnetsisnoC tnemyaP TIOTLLDMFnoereiafmacogwwfyrdearsee eerelP l aeBr y PaSRs de TrsPele ooyrtdafa owceDy denCrm uesePdre seena R TsdynFcee mieitftlrseis mne rgnesstn sc es ycnetsisnoC smreT PIMFSInaFnnelecaeoccotywwgrrwimrvaeeeeei taatrPre iRyvss naPT eeeeyrtadd fa mpseT dtCsrrae eleeyDron ennmRuwtddcseee eis fotsnes rot r effnecreesd Trade References 8 FINANCIAL HEALTH BEST PRACTICES  Collect the Standard Documents – Taxes, Financials, etc.  Examine the credit data you have access to – Business Credit Scores – Payment History Scores  Credit Reports – Credit Scores – Payment Scores – Recommend that you look at more than one source  Additional Information – Lawsuits – Liens – Litigations  News – Mergers and Acquisitions – Executive Changes 3 04/29/2013 SCORING ACH AND RDC RISK  Combining business and transactional elements in a formal risk management program – Transactional Risk Value Type of transaction Type of customer – Business Risk Underwriting the origination client On-going monitoring of that client WHAT ARE THE RISKS?  Fraud  Corporate Account Takeover  Tools – Policies and Procedures – Corporate Account Takeover Tool Kits – ID Theft Protection Plans FRAUD BEST PRACTICES  Determine why the customer has come to your FI  Identify sources and destinations of funds for all FI activity  Assess whether a potential client is active in lines of business that are statistically more associated with unfair, deceptive or abusive marketing and sales tactics  Require enhanced due diligence process – owners and officers personal credit reports  Review internal requirements for high risk ACH customers: prefunding, balances etc.  Determine if the customer uses multiple FIs for ACH  Determine the nature of other relationships the Originator has within the bank  Document steps taken to obtain and assess information  Document their relationships with Originators and 3rd Parties 4 04/29/2013 WHAT ARE THE RISKS?  3rd Party Senders – Do you know their customers? – Should you?  Tools – Policies and Procedures – 3rd party client list monitoring – Frequent reviews – Monitoring? 3RD PARTY ACH BEST PRACTICES AND POLICIES  Review internal requirements for high risk ACH customers: prefunding, balances etc.  Determine if the customer uses multiple FIs for ACH services  For Third-Party Service Providers and Third-Party Senders: – NACHA publication Third-Party Senders and The ACH Network for additional sound business practices – Track downstream organizations and review/assess each as if it were to a direct Originator  Perform due diligence around regulatory, business and consumer issues: – Research with the FTC: – Research with the Better Business Bureau:  Perform reviews of the business and principals – Utilizing independent third-party databases – Validate information about the business and its principals – Identify any judgments against or negative news related to the company and/or its principals,  Research complaint websites – www.ripoffreport.com – www.complaints.com WHAT ARE THE RISKS?  Business Practices – Business Types – Business Models – Industries  Tools – Policies and Procedures – Monitoring 5 04/29/2013 IDENTIFY ACH LINE OF BUSINESS BASED POLICIES  Define criteria for classifying ACH clients as High Risk – Industry classifications of specific concern to ACH:  Money Service Businesses (MSBs)  Third party providers/processors  Gaming, Adult entertainment  Sellers of credit products  Identify classifications of specific concern to ACH:  Do you have a standard set of SEC Codes, Payment Types  Ensure that the nature of the transactions originated fits with the nature of the customer’s business  Review potential exposure limits  Determine if they will typically exceed a certain threshold  Review return rates and expectations for ongoing return rates  Determine additional reporting requirements  Determine frequency of monitoring and review of activity 16 BEST PRACTICES WE CAN IMPLEMENT NOW  ACH RDC Process Improvements  Better Risk Assessments  Better Identification and Categorization of ACH and RDC Risk  Defining ACH Temporal Risk  Calculate ACH Risk  More Frequent Monitoring – Business and Origination SUPPORT YOUR RISK MANAGEMENT PROCESS Model – Forecast – Report  Assess Risk and Approve the Relationship  Set ACH Limits & Compile Metrics  Identify ACH Risk and Timing - Assign Risk Rates  Calculate Expected Risk  Capture Actual ACH Volume  Calculate Actual ACH Risk  Evaluate ACH Risk Impact  On-Going ACH Risk Calculations Monitoring  Monitor ACH Risk Activity 6 04/29/2013 BEST PRACTICES  Risk Assessment  Underwriting & Onboarding  Modeling  Monitoring BEST PRACTICES  Assessments – Initial and Ongoing – Comparatively – Data Gathering  Tools – Tax Returns – Financials – Banking Relationships – Other Relationships – Credit Reports BEST PRACTICE: CATEGORIZE YOUR ACH AND RDC BUSINESS  Organize/Classify your ACH and RDC Business Risk  Risk and Transaction Size – Up to $10,000 – Up to $25,000 – Up to $50,000 – Up to $100,000  Risk and Customer Type – Low Risk: Utilities, School Districts – High Risk: MSB, Check Cashing  Risk and Banked vs. Non Banked – ACH and RDC “only” clients have to be looked at differently – no data 7 04/29/2013 DEFINE ACH AND RDC RISK PHILOSOPHY “TEMPORAL RISK” SEC Risk % #1 Time frame #1 Risk % #2 Time frame #2 PPD – Credit 100% 2 days 0% 0 days PPD – Debit 2% 2 days 0.5% 58 days BOC – RDC …? POP – RDC X9.37 – RDC POS – RDC CCD WEB TEL MODEL AND CALCULATE ACH RISK Premise: Customer Originates - $ 100,000debits weekly $ 25,000credits semi monthly Estimated Risk Expiration Date Amount Debit/Credit Loss % Days of Risk Date Risk AmountAccumulated Risk 1-Sep $ 100,000 D 2.00% 2 3-Sep $ 2,000 $ 2 ,000 3-Sep $ 100,000 D 0.50% 58 31-Oct $ 500 $ 2 ,500 3-Sep $ ( 2,000)$ 500 8-Sep $ 25,000 C 100.00% 2 10-Sep $ 25,000 $ 25,500 8-Sep $ 100,000 D 2.00% 2 10-Sep $ 2,000 $ 27,500 10-Sep$ 100,000 D 0.50% 58 7-Nov $ 500 $ 28,000 15-Oct$ 100,000 D 0.50% 58 12-Dec $ 500 $ 30,500 $ (27,000)$ 3 ,500 20-Oct$ 100,000 D 2.00% 2 22-Oct $ 2,000 $ 5 ,500 22-Oct$ 100,000 D 0.50% 58 19-Dec $ 500 $ 6 ,000 $ ( 2,000)$ 4 ,000 27-Oct$ 25,000 C 100.00% 2 29-Oct $ 25,000 $ 29,000 27-Oct$ 100,000 D 2.00% 2 29-Oct $ 2,000 $ 31,000 29-Oct$ 100,000 D 0.50% 58 26-Dec $ 500 $ 31,500 MODEL AND CALCULATE ACH RISK 8 04/29/2013 MONITOR THE BUSINESS ACTIVITY YOU NEED SURVEILLANCE…. NOT A SNAPSHOT! MONITOR THE BUSINESS ACTIVITY BEST PRACTICES  Tracking ACH and RDC Risk – Compare Expected to Actual – Frequent Comparisons – Actual Amounts compared to limits 9 04/29/2013 MONITOR THE ACH/RDC ACTIVITY Credit Information ACH and RDC Modeling Business Trends over 180 days BANKPLUS BEST PRACTICES • Kelly Kiker, – First Vice President and Director of Transaction Systems • BankPlus – BancPlus Corporation is the parent company of BankPlus, which was founded in 1909 as Citizens Bank & Trust Company (CB&T), in Belzoni, Mississippi. – The name was changed to BankPlus in September 1994, when Southeast Mississippi Bank in Quitman was merged into the banking system, extending the BankPlus service area to southeast Mississippi. – BankPlus has grown from $156 million to over $2 billion in total assets. – 60 offices in 33 Mississippi communities. 10