BSA/AML Examination Manual - ffiec

Electronic Banking — Overview
linked accounts (e.g., common addresses, phone numbers, e-mail addresses, and tax
identification numbers). In determining the level of monitoring required for an account,
banks should include how the account was opened as a factor. Banks engaging in
transactional Internet banking should have effective and reliable methods to authenticate
a customer’s identity when opening accounts on-line and should establish policies for
when a customer should be required to open accounts on a face-to-face basis. 161 Banks
may also institute other controls, such as establishing transaction dollar limits for large
items that require manual intervention to exceed the preset limit.
Remote Deposit Capture
Remote Deposit Capture (RDC) is an emerging technology that has made processing
checks and monetary instruments (e.g., traveler’s checks or money orders) more efficient.
In broad terms, RDC provides a means of depositing checks into a bank account by
scanning the checks and then transmitting the scanned or digitized image to a financial
institution. This eliminates the need for face-to-face contact that results from in-person
deposits, and reduces the cost and volume of paper associated with physically mailing or
depositing checks or monetary instruments. Because the hardware needed to facilitate
RDC transactions can be expensive, customers using the service are primarily business
entities, although some banks also offer remote deposit services to their foreign
correspondents.
Risk Factors
RDC may expose banks to various risks, including money laundering, fraud, and
compromised transmission of financial data. Inadequate controls could result in the
transmission of fraudulent monetary instruments, exposing the bank to financial and
reputational risks. Because RDC equipment is located outside of bank facilities, data and
hardware security issues may increase.
Risk Mitigation
Management should develop appropriate policies, procedures, and processes to mitigate
the risks associated with RDC services and to effectively monitor for unusual or
suspicious activity. Examples of risk mitigants include:
• Creating RDC customer parameters, which may include a list of acceptable industries
approved for RDC services, standardizing underwriting criteria (e.g., credit history,
financial statements, ownership structure of business, types of business customer),
and setting maximums for large dollar items.
161 For additional information, refer to Authentication in an Internet Banking Environment issued by the
FFIEC, October 13, 2005.
FFIEC BSA/AML Examination Manual 189 8/24/2007