Embed Size (px)
Citation preview
Setting and Monitoring Effective ACH Exposure Limits
Presented by Laura Nelson, AAP NCP Education Specialist/Auditor
Questions
Handouts
Audio
Presented by:
PAR/WACHA-The Premier Payments Resource Laura Nelson, AAP, NCP
Education Specialist / Auditor 262-345-1245 or 800-453-1843
www.wacha.org [email protected]
2017
Setting and Monitoring Effective Exposure Limits
WACHA, through its Direct Membership in NACHA, is a specially recognized and licensed provider of ACH education, publications and support.
Regional Payments Associations are directly engaged in the NACHA rulemaking process and Accredited ACH Professional (AAP) program.
NACHA owns the copyright for the NACHA Operating Rules & Guidelines. The Accredited ACH Professional (AAP) is a service mark of NACHA. No part of this material may be used without the prior written permission of
WACHA This material is derived from collaborative work product developed by
NACHA ─ The Electronic Payments Association and its member Regional Payments Associations, and is not intended to provide any warranties or legal advice, and is intended for educational purposes only.
© 2017 WACHA All rights reserved
Disclaimer
ACH Transaction Flow
with Third Parties
RECEIVER ORIGINATOR ODFI
ACH OPERATOR
RDFI
Third Party Processor/Receiving Point
Third Party Processor/Sending Point
Third Party Processor/Sender
ODFI
ABC Company
Co/ODFI agreement
Hardware Store
Payroll Company
Grocery
Bike Shop
Church
Dry Cleaner
Day Care
Third Party Sender
No agreements with originators
� Identifying and Managing Credit Risk
� Setting Exposure Limits
� Monitoring Exposure Limits
� Originator Review
Agenda
Identifying and Managing Risk
� Credit (Exposure) Risk � Operating Risk � Fraud Risk � Reputational Risk � Systemic Risk
Types of Risk
� The risk that a party to a transaction will be unable to provide the necessary funds for settlement to occur
� Losses due to Credit Risk typically result from the failure or bankruptcy of a company
� ODFIs are responsible for controlling credit risk
� Develop and implement credit monitoring and control procedures
What is ACH Credit Risk?
� ODFI exposure for credit entries � Period of time between the initiation of ACH credit file until the
company funds the account � Amount of risk based on total amount of the file
� Up to 2 days
ACH Credit Risk-Credit Entries
Day One Day Two
ACH credit file is sent from Eagle Bank’s account is charged Johnson Construction to Eagle by the Federal Reserve Bank - Bank totaling $15,000 $15,000 Entries are effective on Eagle Bank debits Johnson Construction ‘s Day Two account $15,000 Eagle Bank processes file RDFIs credit Receiver’s accounts and delivers transactions to the ACH Operator ACH credits are delivered to the RDFIs by the ACH Operator
Origination of ACH Credit File Johnson Construction
ODFI’s Credit Risk Exposure $15,000
Day One Day Two ACH credit file is sent from ACH credit file is sent from Johnson Construction to Eagle Johnson Construction to Eagle Bank totaling $10,000 (file 1) Bank totaling $5,000 (file 2) Entries are effective on Entries are effective on Day Four Day Three
Eagle Bank warehouses the items Eagle Bank forwards items from from file 1 and forwards file 1 and file 2 to the ACH them to the ACH Operator Operator today on Day Two
ACH credits are delivered to the RDFIs by the ACH Operator today No settlement for any items has occurred
Origination of ACH Credit File Multi-day/Multi-file
Day Three Day Four ACH credit file is sent from Eagle Bank’s account is
charged Johnson Construction to Eagle by the Federal Reserve Bank - Bank totaling $2,000 (file 3) $12,000 (total of file 1 and 3)
Eagle Bank debits Johnson Construction
Entries are effective on account $12,000 Day Four
Eagle Bank processes file and delivers transactions to the ACH Operator today Eagle Bank’s account is charged By FRB $ 5000.00 (for file 2) and Eagle Bank debits Johnson Construction account $ 5,000.00(for file 2)
Origination of ACH Credit File Multi-day/Multi-File
� ODFI Exposure � Date funds available to Originator until debits can no longer be
returned by RDFIs
� 2 Banking days (24 hrs) � Up to 60 days from settlement � Unauthorized could be returned as ODFI warrants
authorization � Amount of risk based on amount of returned ACH debit
� NOTE: Statute of Limitations – 7 years for most states where the ODFI would still be liable
ACH Credit Risk – Debits
Origination of ACH Debit File Stay in Shape Fitness (SISF)
Day 1 Day 2 Day 3 Day 4 ACH debit Eagle Bank RDFI Eagle Bank file sent from credits SISF’s returns ACH receives ACH SISF to account for debit due to debit return Eagle Bank the total NSF funds in the
amount of Receivers’ the ACH file account Eagle Bank
Eagle Bank charges back delivers the ACH debit File to ACH Debit return to SISF the ACH is received Operator by RDFI
ODFI’s Exposure
If an Originator transmits $100,000 in credit Entries in the morning, designated for three different processing windows as follows:
Same Day 10:30 AM ET Window: $70,000 Same Day 2:45 PM ET Window: $20,000 Next-Day Window: $10,000
As files are released and settled throughout the day, the amount of credit exposure the ODFI has outstanding decreases as settlement occurs for each processing window.
How Does Can an ODFI’s Credit Exposure Change through the day with Same Day ACH?
3:0
0 A
M
4:0
0 A
M
5:0
0 A
M
6:0
0 A
M
7:0
0 A
M
8:0
0 A
M
9:0
0 A
M
10
:00
AM
11
:00
AM
12
:00
no
on
1:0
0 P
M
2:0
0 P
M
3:0
0 P
M
4:0
0 P
M
5:0
0 P
M
6:0
0 P
M
7:0
0 P
M
8:0
0 P
M
9:0
0 P
M
10
:00
PM
11
:00
PM
12
:00
mid
nig
ht
1:0
0 A
M
2:0
0 A
M
3:00 AM - ACH Opens 6:30 PM - Fedwire closes 2:15 AM - ODFI Total Daily Exposure Deadline Next-Day
TransactionsRemaining Daily Exposure = $100,000 - $70,000 = $30,000
Remaining Daily Exposure = $30,000 - $20,000 = $10,000
Daily Exposure Not Previously Settled
$100,000First Settlement Window 1:00 PM
Second Settlement Window 5:00 PM
$10,000
Setting Exposure Limits
� A maximum total limit established by an ODFI for each of its Originators beyond which the ODFI is unwilling to process additional ACH files
� This limit is established under the ODFI risk management and fraud programs
� NACHA Rules require the ODFI to set and monitor these limits
Setting Exposure Limits
� ODFI is required to set, monitor and periodically review exposure limits in accordance to the ACH Rules and OCC and FFIEC Guidance
Setting Exposure Limits
� Article 2 subsection 2.2.3 …the ODFI must:
� Assess the nature of the Originator’s or Third-Party Sender’s ACH Activity and the Risk it presents
� Established, implement and periodically review and set exposure limit for the Originator or Third-Party Sender
� Establish and implement procedures to: � Monitor the origination and return activity across multiple
settlement dates � Enforce restrictions on the types of entries that may be
originated � Enforce exposure limits
NACHA Rules on Exposure Limits
� There are NONE!!!! � It is up to the ODFI to implement an effective risk
management system and control of this system.
Formal Guidelines for Establishing Exposure Limits
X
� Manage Credit Risk by establishing policies, procedures and limits that acknowledge the risks originators bring to an ACH operation
The OCC & FFIEC Guidance Say to…
� Obtain a completed Application for ACH Origination � Ensure a company official has signed and dated
the form, and that all information has been provided
Application
For Example Only
For Example Only
� Obtain applicable financial information and documentation for the company: � Corporate Resolution or Partnership Agreement � Credit Report (or Dun & Bradstreet Business Credit
Report) � Financial Statements (Signed and Dated by an
Officer) � Tax Returns � Credit References � Recent Transaction/Sales History
Know Your Customer (KYC) Information Collection
For Example Only
� Identify/Avoid high risk customers � Is this an acceptable type of business � Is the originator financially stable
� What are the originator’s ACH needs? � What is the originator’s current use of technology? � What are their risk management practices and
controls? � Will the originator follow ACH rules/regulations? � Do they want to use Same Day ACH?
Know Your Customer (KYC) Information Collection
� Require Evaluation of the originator's creditworthiness, including a comprehensive financial analysis (similar to that performed on other potential unsecured borrowers) � Coordinate the monitoring procedures among the
various departments � Do they already have a borrowing relationship?
� Assign Risk Levels/Ratings � Work with Commercial Lending/Treasury
Management � Rate individually or by class of customer � Type of Business
Evaluation General Underwriting Standards
� Credit Review � Credit Bureau Report � Dunn & Bradstreet Rating
� Financial Statement Review � Last 1-5 years
� Overall Originator Relationship � Lending Relationship � Past transaction history
Due Diligence Process
� Require a Background check of the originator to validate the legitimacy of the business (if necessary, this check can be supplemented with a background check on the principal business owners of the originator)
� Dun & Bradstreet � LexisNexis � Better Business Bureau � State Corporation Records � Open source research (public websites like ripoffreport.com,
complaintsboard.com, etc.) � On-site visits � TOD- Terminated Originator Database
General Underwriting Standards
� 1 Highest quality/Lowest Risk � 2 High quality/Low Risk � 3 Upper medium quality/Average Risk � 4 Medium quality/Average Risk � 5 Lower medium quality/Average Risk � 6 Substandard quality/High Risk � 7 Poor quality/High Risk � 8 Loss/High Risk
Risk Rating by Class
For Example Only
� Credits � Automatic File Suspension � Prefunding � Pledge Collateral
� Debits � Delay posting of funds to Originator’s account � Place hold on funds
High Risk Originator
risk $$$
� Who evaluates information? � Who assigns risk rating? � Who approves?
� Different levels based on amounts? � Who approves Third-Party Senders/High Risk
originators? � Is the exposure limit aggregated with other credit?
Documenting Exposure Limit Approval
Branch Manager Relationship Mgr Credit Manager Credit Committee Board of Directors Cash/Treasury Mgmt
� In general, exposure limits should be based on five separate criteria: � 1) Customer Credit Ratings � Work with Commercial Lending area � Rate individually or by class of customer � Prefunding
� Uniform Review Procedures � Periodic Review of All Originators � Procedures for deteriorating customers � Respond to changes in customers’ financial condition
Exposure Limits
� 2) The overall customer relationship � Well established customer vs new business
� 3) Individual subsidiaries/divisions of a company � Is company part of a nationwide chain?
� 4) The specific ACH application � PPD/CCD � Check conversion (ARC, BOC, POP, RCK) � WEB & TEL � Internet banking
� 5) The historical or predicted dollar value of files processed � Payroll—Large $$ entries � Monthly billing—Lower $$ entries but more volume
Exposure Limits
� ODFIs have less exposure time for same-day credits � ODFI is liable for credits put into the system, and
more frequent settlement reduces time for an Originator to fail, go bankrupt or have funds frozen
� Prefunding may be easier � If the debit is coming from an external financial
institution, that needs to be considered
Same Day ACH Considerations
For Example Only
For Example Only
� Establish mandatory exposure limits. � Maximum Per Transaction Limit = $________ � Maximum Per File Limit = $________ � Maximum Per Day Limit = $________
� For ACH Credit Transactions: � Aggregate Credit Limit Over 2 Days or 1 Day =
$________ � For ACH Debit Transactions:
� Aggregate Debit Limit Over 2, 60 or 90 days = $________
Exposure Limits
*Example Only*
� Low Risk 1.5 times the file amount � Average Risk 1.3 times the file amount � High Risk 1.1 times the file amount
File Limit Multiplier
� Credit File---Average Risk Originator $75,000 average file size X 1.3 Multiplier $97,500 Exposure Limit
*Origination until settlement of file
Exposure Limit Calculation *Example Only*
� Debit File---Average Risk Originator $50,000 average file size X 1.3 Multiplier $65,000 Exposure Limit *Origination only
Exposure Limit Calculation *Example Only*
� Exposure Limits should be relative to the file amounts � Example: � Originator qualifies for a $100,000 exposure limits � Estimated amount of files are $25,000
� What should this originators exposure limit be???
Setting Exposure Limits
� Assess the risk from originating ACH entries through a third-party service provider � Develop procedures to limit liability and risk
Do the steps to qualify a Third Party differ from that of an Originator?
ODFI
ABC Company
Co/ODFI agreement
Hardware Store
Payroll Company
Grocery
Bike Shop
Church
Dry Cleaner
Day Care
� Ensure that Exposure Limits along with monitoring and review procedures are addressed in the agreement between the FI and the Originator/Third-party Sender
� Provide authorization procedures for approved originators
� Allow the bank to audit originators' ACH processes and controls at the bank's discretion
Originator Agreements
� When exposure limits have been established, � Implement procedures to monitor all originated
files � System to suspend files if exposure limit is exceeded
� Not processed � Hold for approval � Contact account manager
Exposure Limit Monitoring and Over Limit Approval
� When a file is over the established limit, � Who is authorized to make decisions and/or
release or suspend the file � What procedures are followed � Procedures to handle suspended files � Procedures to temporarily increase an exposure
limit � Log of file suspensions and return items
Monitoring Exposure Limits
� Monitor activity for consistency � Consider establishing activity thresholds beyond which
additional reviews may be necessary, such as: � Excessive over limit files � Rapid increases in number of transactions and/or dollar
volume � Changes in the debit/credit mix � Increases in the number and/or percent of overall returns � Track the number of requests for proof of authorization for
originated transactions � Proper use of SEC codes � OFAC
Monitoring and Reporting
� Determine internal process for correcting unacceptable activities � Consult with customer to change the business
practices that lead to high risk activity � If activity persists, may include revoking ACH
origination services and/or existing the relationship
Monitoring and Reporting
� Relationship level � Are records linked in some manner for exposure
aggregation? � Do you monitor risk across payment channels?
� Remote Deposit Capture � ACH � Check/Image � Loans � Wire Transfer � Card
Cross Channel Risks
� How do you ensure that the files are truly coming from your Originator � Authorized Signature � Call back process � IP Address Verification
� Do you carry insurance for origination losses?
Account Takeover
� Coordinate the review among the various departments
� How Often � Annually � Ad Hoc
� Based on Market Conditions � Change in Services � Upon the receive of an alert (Fraud, money laundering
etc)
Periodic Review of Originators
� Uniform Periodic Review of All Originators � Monitor and respond to changes in customers’
financial condition � Changes in Volume or File Totals � Change in SEC code needs � Return tracking
Periodic Review of Originators
� Determine internal processes to terminate a customer or to deny a customer additional services, lines of credit, etc. � Be specific in the reasons, including any relevant
data or specific activities � Communicate with internal departments to
understand the nature of the customer’s activity � Record the individuals and departments involved
in the decision
Termination of Originators
� Outline originator account Termination procedures � How do you determine that an Originator should
be terminated? � Excessive violations of over-limits situations � Breach of agreement � Legal review � Prior warnings � Coordination with other areas (branch, lending,
loss prevention, AML, etc.) � Keep written documentation
Termination of Originators
QUESTIONS
Setting and Monitoring Effective Exposure Limits
This session is worth 1.8 credits
AAP Continuing Education Credits
� PAR/WACHA- The Premier Payments Resource � HELP DESK
� Phone: 262-345-1245 � Toll Free: 800-453-1843 � Fax: 262-345-1246 � [email protected]
Resources
Laura Nelson, AAP, NCP
Upcoming WACHA events with CBANC Education:
Same Day ACH Phase 2: Preparing for Debits Reg E for Debit Cards Effective Origination Agreements
Mon 6/19 at 1pm CT/2pm ET Tues 6/20 at 1pm CT/2pm ET
Tues 7/11 at 1pm CT/2pm ET
