Top Banner
F F FFIEC Guidance on Remote FFIEC Guidance on Remote Deposit Capture Dan Fisher The Copper River Group, Inc. Email: [email protected] Speaker
28

F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

Sep 03, 2020

Download

Documents

dariahiddleston
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

F F FFIEC Guidance on RemoteFFIEC Guidance on

Remote Deposit Capture

Dan FisherThe Copper River Group, Inc.

Email: [email protected]

Speaker

Page 2: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

Dan Fisher

Dan is President and CEO of The Copper River Group offers consulting and research services to the financial industry with an emphasis on payments systems, information and technology strategies for independent community banking organizations.

He has been in technology and banking for over 30 years. He has been a director of the Federal Reserve Bank of Minneapolis, Chairman of the ABA Payments Committee, a member of the ICBA Payments Committee and participated in the industry effort with the Federal Reserve that ultimately succeeded in the passage and implementation of the Check-21 legislation. He has authored or co-authored six books and has written numerous articles and white papers on technology, operations and the payments system. His most recent book titled, Capturing Your Customer, focused solely on Remote Deposit Capture.

2

Page 3: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

Presentation ContentTHIS PRESENTATION IS DESIGNED TO PROVIDE ACCURATE AND AUTHORITATIVE INFORMATION REGARDING ITS SUBJECT MATTER. IT IS PRESENTED WITH THE UNDERSTANDING THAT THE PRESENTERS ARE NOT RENDERING LEGAL, ACCOUNTING, OR OTHER PROFESSIONAL SERVICES.

3

Page 4: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

• FFIEC Press Release 1-14-09

• Focus on Risk• Identifies the essential elements of risk• Engages the senior management in their

responsibilities • FFIEC Retail Payments Exam Procedures

manual will be updated in 2009 to include RDC

4

Page 5: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

• Overview

• Guidance should not be construed as a specific regulatory requirement, however, the expectation is that, within the scope of the guidance, financial institutions, service providers and other entities should take steps that are at least equivalent in compliance with the guidance

5

Page 6: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

• Scope (The Guidance raises the bar!)

• Goes beyond just a discussion of technology

• It engages:• The Board of Directors• The senior management team • All potential stakeholders• It sets a new tone in regard to exam scrutiny

and signals increased rigor, intensity and accountability

6

Page 7: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

• The Guidance

• Remote Deposit Capture is defined as:

• Deposit transaction delivery system (digitizing of deposit documents)

• Transmission of Non-Public information• Movement of money

7

Page 8: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

• The Guidance • Expands the scope of Remote Deposit

Capture to include:

• Commercial RDC • Retail RDC• ATM Capture• Teller Capture• Branch Capture • Image Capture (back office operations)

Note: Also includes Fax and Cell Phone pictures of checks

8

Page 9: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

• Risk Management

• Asserts that RDC does in fact create additional risk

• Establishes the expectation of conducting a Risk Assessment prior to the implementation of the product

9

Page 10: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

• Risk Management

• Engages senior management in the process

• Establishes that RDC should be consistent with the strategic direction of the organization

10

Page 11: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

• Risk Management

• Establishes that the ability of the organization to manage the risk should be identified and demonstrated

• Establishes that RDC should be incorporated into the organizations risk assessment and information security processes.

11

Page 12: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

• Risk Management

• Engages Board and management to review and approve:

• Plans • Performance• Risk Management

• Implementation• Reports of ongoing progress

12

Page 13: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

• Risk Management

• Modify information security program to include the identification of associated risks relative to RDC

• Internal• External (customers and service partners)• Type (i.e. ACH)

• Establishes that the Board and senior management are ultimately responsible

13

Page 14: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

14

• Risk Management – Classical Risk

• Legal Risk• Compliance• Operational Risk• Transaction Risk• Fraud Risk• Systemic Risk

Page 15: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

• Operations Risk

• Asserts that senior management should understand the operations risks

• That your organization should conduct a thorough review of the effects of the product and the technology options

15

Page 16: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

• Operations Risk

• Controls and information Security (the internet)

• RDC is considered a movement of deposits• Additional security is needed (i.e. MFA,

security layers and other methods)

16

Page 17: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

• Risk Mitigation

• Caveat… Metrics inform but they do not protect!

• Organizations will need to implement a dynamic and constant risk management plan to include:

• Metrics• Monitoring with ratings or limits

• Activity reporting

• Intervention

17

Page 18: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

• Risk Mitigation

• And not at the end of the month

• The guidance is a very good indication of what is to come….

18

Page 19: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

• Risk Mitigation

• What are the steps that can be taken to implement program that will adequately respond to the guidance

• Develop an involvement plan with the Board of directors, senior management team and all potential stake holders.

19

Page 20: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

• Risk Management and Best Practices

• Update the Risk Assessment and Management policy of the organization

• Review prior to implementation• Reporting (ongoing)• Mitigation and intervention

• Update the Information Security Plan

20

Page 21: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

• Risk Management and Best Practices

• Technology Management Policy• Product definition (where applicable)• Risk Policy• Customer Due Diligence Procedure

21

Page 22: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

• Risk Management and Best Practices

• Vendor Due Diligence Procedure (w/RFP)• Credit review (Note: Not your regular

loan review)• Deposit transactions and payments are on the

liability side and affect liquidity (directly and indirectly)

22

Page 23: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

• Risk Management and Best Practices

• Implementation Procedures• Approval Authority (no shades of gray)• Installation responsibility

• Vendor contact authority• Ongoing

• Customer implementation• Contract execution• Approved pricing• Scheduling

23

Page 24: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

• Risk Mitigation Program

• Activity monitoring (real time)• Intervention• Authority for intervention – in contract• Specific intervention procedures• Specific criteria for intervention

24

Page 25: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

• Risk Mitigation Program

• Update risk assessment process to include:

• Internal (application, sales and implementation)

• External (application, sales and implementation)

25

Page 26: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

• Business Continuation Planning (BCP & DRP)

• In a crisis or service failure, reverting to the old way will not suffice!

Note: Perspective, a remotely located borrower could be adversely impacted if their ability to scan is not functional and an branch office is not nearby.

• Distance relationships are the norm

26

Page 27: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

• Business Continuation Planning (BCP & DRP)

• Have a plan for identifying trouble in advance, not at the last minute

• Have specific procedures defined out• In House Systems• System Specific BCP• Out Sourced Systems• Vendor specific BCP

27

Page 28: F F FFIEC Guidance on Remote FFIEC Guidance on Remote ...media.techtarget.com/...MainBallroom_Session6_RDCFFIECGuidance… · F F FFIEC Guidance on Remote FFIEC Guidance on Remote

• Summary• Questions

28

www.copperwombat.com

Email: [email protected]