Same Day ACH Transaction Risk The Clearing House Puerto Rico Payment Symposium August 21, 2015 EPOCPR Services Same Day Risk • Agenda: – Same Day ACH Background • Settlement • Operations • Returns – Risk Associated with Same Day ACH • ODFI • RDFI • Possible fraud schemes – How can the Risk be Mitigated EPOCPR Services Same Day !!!!! • The introduction of the Same Day ACH transactions will be made in phases. – Phase I: only credits by September 16 2016, – Phase II: debits will be added by September 15,2017, – Phase III: two new windows will be added 10am ET, 3:00pm ET and funds should be available by 5:pm ET – RDFI’s are required to accept and post all Same Day ACH transactions received. – ODFI’s aren’t required to originate any Same Day ACH transactions. EPOCPR Services SAME DAY!!!!! - Transaction format will be the same, the only differentiation being is the transaction settlement date will match the file’s date in which was received for processing. - IATs and transactions over $25,000.00 will not qualify for same day processing. - An Interbank Fee of 8.2 cents per transaction will be assessed to the ODFI and paid to the RDFI . EPOCPR Services SAME DAY!!!!!! - What is good about it? - Settlement- by reducing the settlement window, same day ACH reduces credit risk associated with the network. - Operations – Same Day ACH provides additional processing windows that results in risk reduction opportunities. Example : Ease the pressure on deadlines, or could be used as a contingency alternative. - Returns- Exceptions may be identified sooner and returned sooner. EPOCPR Services RISK ?????? • What about Risk? -. Same Day ACH transactions on its own likely represents little impact other than additional resources that may be needed to support more frequent processing same day credits and eventually debits. • ODFI - still be liable for the transaction risk. • RDFI – still be required to accept and process same day ACH transaction • BUT WHAT DOES IT MEANS AS IT RELATES TO RISK IN THE PAYMENT SYSTEM? – CRIMINALS WILL FURTHER EXPLOIT ACCOUNT INFORMATION TO MOVE FUNDS QUICKLY OUT OF THE SYSTEM. – FASTER PAYMENTS MAY ACTUALLY EXPAND THIS RISK; GIVEN THERE WILL BE LESS TIME FOR REVIEW THE TRANSACTIONS – THIS WILL PLACE A GREAT AMOUNT OF PRESSURE ON OPERATIONAL PROCESSES AND STAFFING – A TRANSACTION WILL BE HARDER TO RETRIEVE IF IT TURNS OUT TO BE FRAUDULENT. EPOCPR Services RISK ????? - SAME DAY ACH WILL PROVIDE THE CRIMINALS WITH THE OPTION OF MOVING THE FUNDS FASTER OUT OF REACH. SOME OF THE SCHEMES COULD BE: * SUBMIT LARGE VOLUME OF PAYMENTS JUST BEFORE THE CUT-OFF TIME. * SUBMIT PAYMENTS THAT ARE JUST UNDER INSTITUTION’S REVIEW * TARGET OTHER CHANNELS OR PAYMENTS TYPES * USE OF SOCIAL MEDIA AGAINST ACCOUNT HOLDERS, RESULTING IN PAYMENTS THAT LOOK LEGITIMATE. * ADD RECIPIENTS TO PAYROLL FILES OR CHANGE ACCOUNT INFORMATION * COMPROMISE THIRD-PARTY SENDERS AND SUBMIT FRAUDULENT PAYMENTS EPOCPR Services RISK ????? In the Same Day ACH environment there is an increased probability that the RDFI will allow their customer to transfer the funds out of the account before the originator and the ODFI realizes that transactions were fraudulent. How to prevent it from happening???? • Regulatory agencies are expecting banks to do real-time monitoring on ACH transactions. • Real – Time monitoring of credits • New requirement how often do you do due diligence on your ACH customers. • You MUST do KYC for third party senders as well. EPOCPR Services RISK ????? - The bank can only manage what it “monitors”. Monitoring is even more critical than fraud itself, because can help you define what is normal. - Think of security in layers: * Malware detection * Multifactor authentication * Monitoring & Prevention : Transaction Data level patterns * Multiple processes - Transactions to be scrutinized in REAL-TIME. * Unknown receivers * Out of Calendar pattern * Tardy originators * Debit returns losses \ unfunded credits * Duplicate files and batches EPOCPR Services RISK ????? * Originator behavior * Detailed metrics and trends analysis * Volume and dollar limits * Risk Exposure * Nacha Rules violations - We concluded that faster payments may expand the risk, since is less time for transaction risk reviews, the possible solutions is: - * Strong authentication in place before funds are moved - * Validate sender and recipient accounts - * Real-Time validation - * Review process should be automated EPOCPR Services