ACH Origination and the Risks Your Bank Should Consider

1
ACH Origination and the Risks Your Bank Should
Consider

• Presented by
• John A. Mills, AAP
• BKD, LLP
• February 7, 2008

2
ACH Origination and the Risks Your Bank Should
Consider

• Presented by
• John A. Mills, AAP
• BKD, LLP
• February 7, 2008

3
Overview

• Requirements of ACH Origination
• Risk Concerns
• Mitigating Risk
• Monitoring Risk
• Examples
• Summary

4
Requirements of ACH Origination
5
ACH Requirements

• Enrollment and approval processes
• Signed agreement between the Originator and ODFI
• Ensure Originators follow the ACH Rules
• Establish an ACH exposure limit for each
  originator
• Conduct an annual audit of the ACH program
• Having an ACH Policy approved by the Board of
  Directors is strongly recommended

6
Establishing Exposure Limits

• Type of ACH being used (Customer)
• Risk associated with the ACH type (Operations
  Dept)
• Projected volume (Customer)

• Customers financial position (Loan Dept)
• ACH Rules require exposure limits to be reviewed
  on at least an annual basis

7
Requirements of ACH Audit

• Conduct by December 1st of each year
• Retain a copy for six years
• Meet the requirements of Appendix Eight in the
  ACH Rule Book
• Provide to the National Automated Clearing House
  Association (NACHA) upon request

8
ACH Policy

• Management Policy
• Credit Policy
• Audit Policy

9
Management Policy

• Define acceptance of ACH transactions
• Late returns and ODFIs request for return
• Outline the approval process for new ACH
  Originators and the review process for existing
  ACH Originators

• Handling of exception files
• ACH Services offered
• Alternatives for ACH file receipt
• ACH Pricing
• Processing Schedule

10
Credit Policy

• Outline staff approval limits
• Credit rating system
• List the requirements to determine exposure
  limits
• Ongoing monitoring and review of exposure limits

11
Audit Policy

• Frequency
• Scope Appendix Eight in the ACH Rule Book
• Review Method

12
Risk Concerns
13
ACH Origination Risks

• Security Breach
• Originator is not following the ACH Rules
• Originator declares bankruptcy
• Originator commits fraud
• Third Party Service Providers

14
Risks to Originators

• Employee fraud
• Receiver authorizations
• Not following the ACH Rules

15
Mitigating Risks
16
Steps to Reduce Risk

• Encourage intra-department communication
• Develop and utilize ACH reports
• Enhance and follow security procedures
• Document all over-limit activity and keep
  approvals in the originators file
• Provide on-going education for staff and
  originators

17
Steps to Reduce Risk (cont.)

• Best Practices
• Audit originators
• Discuss dual control with originators
• Require pre-funding for high risk originators
• Require the originator to maintain a reserve
  account
• Know Your Customer!

18
Monitoring Risks
19
Monitoring Information

• Volume and Growth
• Returns
• Losses
• Fee Income

20
ACH Reports

• Operations Manager
• Account Manager
• Board of Directors
• Everyone involved with ACH

21
Examples
22
Example 1

• A fitness center collects membership dues via the
  ACH Network. They send two hundred debits for
  30 each. If the company sends this file four
  times a month, what is the Banks exposure?
• Answer The bank is exposed for 6,000 sixty
  days after each file is sent. Since this company
  submits four files per month, the Bank could be
  exposed to as much as 48,000 for each rolling
  sixty day period.

23
Example 2

• A company sends a 100,000 payroll file each
  week. What is the Banks exposure?
• Answer Since this is a credit file, the Bank is
  exposed for 100,000 each time a file is sent.
  The Bank is exposed from the time the file is
  submitted to the ACH Operator until the customer
  funds the payroll. Credits can be sent to the
  ACH Operator up to two days before the effective
  date.

24
Summary Take Aways

• Establish an ACH policy
• Operating under Board approved risk
• Set and review exposure limits
• Annual review to ensure customer is still in a
  positive standing
• Monitor and report ACH activity
• Develop logs and provide reports to management
• Communication
• Throughout your financial institution
• NACHA
• Future changes

25
Questions?

• John A. Mills, AAP
• jmills_at_bkd.com
• Phone [phone], x347
• Fax [phone]