ACH Risk Management:

ACH Risk Management:Where Are We Now ­ Where Are We Going?Jeanette A. Fox, AAP, Senior Director, NACHAPeter Hohenstein, CCM, Senior Vice President, Bank of AmericaRoy DeCicco, CCM, Managing Director, JPMorgan Chase© 2008 National Automated Clearing House Association. All rights reserved.

Agenda•The ACH Network•Risk as a Strategic Priority•Risk Management Framework•Risk Management Advisory Group–Formation and Initiatives•Questions© 2008 National Automated Clearing House Association. All rights reserved.2

ACH Transaction Volume(billions)1816141210864201997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007© 2008 National Automated Clearing House Association. All rights reserved.3

Why Is ACH Risk Management aStrategic Priority?• The ACH Network is a safe payments system–NACHA, its members, and the ACH Operatorshave a responsibility to ensure that the ACHNetwork remains a safe payments system• Transaction Growth• Spontaneous Transaction Growth• Internet Transaction Growth© 2008 National Automated Clearing House Association. All rights reserved.4

Risk Management Framework• The ACH Network’s plan must be–Long range–Pragmatic–Comprehensive and integrated–Legally sound and defensible–Complement other payment channels’policies–Flexible to support future growth–Address both risk and quality© 2008 National Automated Clearing House Association. All rights reserved.5

Overview•Risk and quality improvements cannot beaccomplished through a single effort orone all­encompassing rule change•Each initiative is a complementary piece ofthe entire strategy© 2008 National Automated Clearing House Association. All rights reserved.6

Overview•Collectively it addresses–Reduced risk by minimizing unauthorizedentries–Improved quality in the ACH Network–Reduced customer service costs© 2008 National Automated Clearing House Association. All rights reserved.7

Risk and Quality Initiative ContinuumHIGHData SecurityStandards• Legal, regulatoryand/or rules­basedTargeted Enforcement•Unauthorized trigger•Reporting•Penalty fees•Possible suspensionOperator Tools•ODFI Understanding•Define roles•Develop warning process•Deploy controlsRISKRisk Strength of InitiativeTerminated Originator/3rd Party Registration•Solution providersdevelopingExpanded Audit•Audit requirements basedon origination complexity•Regulatory complianceQuality Strength of InitiativeCustomer ServiceTelephone Number•Receiver has tool tocontact Originator•Fewer unauthorizedreturns/calls to RDFICompany Name•Better RM tracking•Fewer unauthorizedreturns/calls to RDFIQuality Initiatives•Misuse of Codes•WSUPP/Unauthorized•Adjustments•Requests for Information•Incentive Fees?QUALITY© 2008 National Automated Clearing House Association. All rights reserved.HIGH8

Risk Management Advisory Group(RMAG)•Risk Management Advisory Group(RMAG) was established in 2005 by theNACHA Board•Oversees development of the RiskManagement Framework for the ACHNetwork© 2008 National Automated Clearing House Association. All rights reserved.9

RMAG –The First Term•Framework­driven Rulemaking Initiatives– Network Enforcement Rule– Company Name Identification Rule– Risk Management Assessments– Rules Audit Compliance Enhancements© 2008 National Automated Clearing House Association. All rights reserved.10

Network Enforcement Rule• Enhance National System of Fines•Higher fine levels•Suspension as an option for significant cases•Implemented December 21, 2007• ODFI Reporting Requirements•Defines return threshold•Establishes process and procedures•Allow NACHA risk staff to forward an issue to theSystem of Fines•Implemented March 21, 2008© 2008 National Automated Clearing House Association. All rights reserved.11

Company Name Identification Rule•Clarify Definition of Company Name Field–Adopt standard ID requirements forOriginators and Third Parties–ID should remain throughout transaction lifecycle–Rule Implementation June 20, 2008© 2008 National Automated Clearing House Association. All rights reserved.12

ACH Risk Assessment• Intended to improve risk management andreduce risk in the ACH Network by introducingannual assessments by DFIs of the risks of theirACH activities, scaled to the nature andcomplexity of their activities• Approach is similar to the OCC guidance onmanaging ACH risks (OCC Bulletin 2006­39)• RFC distributed in January• Comment period closed February 29, 2008© 2008 National Automated Clearing House Association. All rights reserved.13

RMAG ­ The Second Term•Risk Management Advisory Group(RMAG) was repopulated in 2007 by anomination process•Continues to oversees furtherdevelopment of the Risk ManagementFramework© 2008 National Automated Clearing House Association. All rights reserved.14

RMAG Current Project Teams•Data Access & Analysis•Data Sharing•Direct Access•New Sources of Risk•Rules, Regulations & Policies•Communications & Education© 2008 National Automated Clearing House Association. All rights reserved.15

Direct Access• Define, identify and develop a risk profile fordirect access relationships• Further define and develop tools needed tomonitor direct access relationships• NACHA Board approved concept March 2008• Policy statement will be forwarded to NACHABoard July 2008–Voluntary registration begins upon approval ofpolicy statement© 2008 National Automated Clearing House Association. All rights reserved.16

Direct Access•For more information –project teammembers–Alex Romeo, EPN, Project Team Chair–Peter Hohenstein, Bank of America–Jim McKee, Federal Reserve Bank of Atlanta–Roy DeCicco, JPMorgan Chase–Steve Helgen, US Bank© 2008 National Automated Clearing House Association. All rights reserved.17

Data Access & Analysis• Partnering with staff to evaluate an advancedtool to analyze risk, enforcement and Networkusage• Raise awareness among Network leadersregarding the importance of quality data– Analytical and predictive© 2008 National Automated Clearing House Association. All rights reserved.18

Data Sharing• Improve Network and individual DFI’s ability toevaluate originators and identify problems• Leverage relevant data available within existingorganizations/databases• Address cross­channel risk issues• Working on possible development of aTerminated Originator Database© 2008 National Automated Clearing House Association. All rights reserved.19

Rules, Regulations & Policies• Address discrepancies that arise in applyingNACHA Rules in conjunction with otherregulations and policies related to risk• Expanding return reason codes ­ focused onnon­compliance and illegal activity–working with NACHA Rulemaking Process’WSUPP Product Group to provideconsistency© 2008 National Automated Clearing House Association. All rights reserved.20

New Sources of Risk• Identify and prioritize potential sources ofemerging Network risk• Risk Assessment Matrix created–Considers reputation, regulatory, customer,financial and other risks–Scaled by inherent risk and residual risk withmitigation factors provided© 2008 National Automated Clearing House Association. All rights reserved.21

Communications & Education•Focus on risk agenda and topics–Payments 2008 Newsletter–RMAG presentation developed with talkingpoints for consistent message across varietyof venues•Developing case studies© 2008 National Automated Clearing House Association. All rights reserved.22

RMAG Members 2007­2009• Roy DeCicco, CCM, JPMorgan Chase –Chairperson• Sharon Barney, KeyBank• Ann­Marie Bartels, AAP, MPX• Jennifer Brock, Synovus Financial Corporation• Joseph Caputo, State Street Bank & Trust• Keith Crockett, Compass Bank• Joe Flannery, AAP, BB&T• Ward Gailey, SunTrust• Mary Gilmeister, AAP, WACHA• Steve Helgen, U.S. Bank• Dan Heller, Wells Fargo• Peter Hohenstein, CCM, Bank of America• John King, MACHA• Fred Laing, AAP, CCM, UMACHA• Devon Marsh, Wachovia Bank, N.A.• Jim McKee, Federal Reserve Bank of Atlanta• Alex Romeo, EPN• Frank Sardina, AAP, EPN• Dennis Simmons, AAP, SWACHA• Sam Vallandingham, The First State Bank• Michelle Yates, AAP, Fifth Third Bank© 2008 National Automated Clearing House Association. All rights reserved.23

Conclusions• Risk mitigation and quality improvement arelong­term, high priority Network objectives.• All Network participants are impacted and willrespond best to framework­driven, legally­soundand business­oriented plans.• Communications and education are key tosuccessful implementation.• Stakeholder involvement is key to properdevelopment.© 2008 National Automated Clearing House Association. All rights reserved.24

Questions?•Questions or feedback for the RiskManagement Advisory Group?© 2008 National Automated Clearing House Association. All rights reserved.25

© 2008 National Automated Clearing House Association. All rights reserved.