End the Headaches of the Risk Assessment Process!

The GLBA MAP

ABA Banking Journal Online

Bank Director

BAI Banking Strategies Magazine

Bank Systems & Technology

Bank Technology News

Credit Union Journal Daily

Credit Union Times

Something Gained, Something Lost

Avoiding errors with the electronic payments processing boom

Part 1 of 2 by Lori Moore, Director of Compliance

It's no secret that the U.S. payment network has rapidly shifted from paper to electronic transactions over the past several years. In fact, as a part of an ongoing effort to measure trends in non-cash payments within the U.S., the Federal Reserve published a study in December 2007 that indicates over two-thirds of all payments processed are now electronic.

The study covers a three-year period from 2003 to 2006 and reflects an estimated increase in the number of electronic payments processed of 12.4 percent per year. In addition, the study indicates that the overall number of non-cash payments processed during this time compared to the previous three-year period increased at a much faster rate. And, as both consumers and businesses continue to gain confidence in electronic payment services, the noted trend is not likely to wane.

Electronic payments: The good and the bad

On most fronts, organizations within the payment industry have welcomed and even encouraged the shift from paper to electronic payments. The obvious advantages include increased efficiency, faster clearing and lower operating costs. However, as with many things gained, there is often the potential for loss.

With the increase in the use and acceptance of electronic payments, compliance and risk management officers should anticipate, or may have already experienced, an increase in claims of unauthorized transactions and other alleged errors subject to the rules of the Electronic Funds Transfer Act (EFTA).

The EFTA, otherwise known as — and implemented by — Regulation E (Reg E), establishes the basic rights, liabilities and responsibilities of consumers who use electronic fund transfer (EFT) services and of the financial institutions that offer these services.

Without a doubt, Reg E is one of the most complex consumer compliance laws in effect today. And, as if it wasn't confusing enough when consumers and financial institutions were dealing with basically only two types of EFTs, (i.e., ACH and ATM/Debit Card), the introduction of various new payment products and instruments over the past several years has further blurred the lines of applicability and liability.

Therefore, as you anticipate a likely increase in the number of claims subject to Reg E, it's imperative that you ensure applicable employees within your institution are properly trained and have a solid understanding of the law. In addition, being aware of the most common violations and frequently misunderstood or misinterpreted provisions or aspects of the regulation will allow your institution to mitigate the related risk and potential consequences.

Common violations

The most common violations cited under Reg E relate to the error resolution procedures set forth under 12 CFR 205.11. Specifically, most of the violations reported pertain to the lack of adherence to the timing requirements of section 205.11(c), which requires the investigation and resolution of an alleged error within 10 business days of receiving a notice from the consumer. The only exception to this timeframe is for an alleged error that involves a new account. In this case, the 10-business-day period extends to 20 business days.

If the alleged error can't be resolved within the timeframe required, the 10-business-day period may extend to 45 calendar days, and the 20-business-day period may extend to 90 calendar days, provided the consumer receives provisional credit for the amount of the alleged error no later than the 10th or 20th business day, accordingly. Furthermore, although the 10-business-day period does not change, for point-of-sale (POS) debit card and foreign transactions, the 45-day calendar period may extend to 90 days.

Section 205.11(c) also sets forth timeframes institutions must follow upon completing an investigation. If the institution extends the investigation period, it must inform the consumer within two business days after provisional credit is given of the date and the amount of the credit provided. Plus, it must give the consumer full use of the funds during the investigation period.

The institution must report the investigation results to the consumer within three business days of determining whether an error did or did not occur.

• If an error did occur, the institution must correct it within one business day. Also, if the consumer received provisional credit, this notice must inform the consumer that the credit is final.

• If an error did not occur or occurred in a manner or amount different from that reported by the consumer, the results report must include an explanation of the institution's findings and inform the consumer of his or her right to request the documents relied on by the institution in making its determination. If the consumer requests the documentation, the institution must promptly provide copies.

In addition to the timeframes and requirements of section 205.11(c), if an error did not occur or differed from that reported by the consumer — when applicable — section 205.11(d) permits the institution to debit the consumer's account for the amount of any previous provisional credit given. However, when revoking provisional credit, the institution must inform the consumer of the date and amount of the debit and must also notify him or her of the following:

For a period of five business days after the date of the notice, the institution must honor checks, drafts or similar instruments payable to third parties and preauthorized transfers from the consumer's account, even in the case of a payment that results in an overdraft. However, the institution is only required to honor items that would have been paid otherwise if the provisional credit had not been revoked.

Cutting the risks of common violations

As a compliance or risk management officer, you can reduce the risk of these common violations and provide reasonable assurance of adherence to the timing and notice requirements of Reg E by developing an effective system of controls. Some examples of processes that may be implemented include:

• Develop a uniform method for documenting received claims.

• Use procedures that ensure claims are promptly submitted to the appropriate department upon receiving a notice of an alleged error.

• Establish a system that ensures the prompt investigation of these claims.

• Ensure the adequate documentation and tracking of steps and status of the investigation.

• Employ a tickler system that prompts the appropriate personnel of approaching timeframes.

• Most importantly, ensure the adequate training of all employees involved in the error resolution.

To provide further assurance of adherence, the compliance or risk management officer should periodically review claims to verify the effectiveness of the procedures established and to identify the need for additional training.

Taking these steps can provide greater assurance of compliance by your institution. However, the institution may still be subjected to violations related to claims your front-line staff does not document or report. These violations frequently occur because of commonly misunderstood or misinterpreted requirements.

In our next article, we will continue our discussion of Reg E, looking at practical examples that illustrate some of the errors that are often not detected until it's too late and unknowingly placing your institution at risk.

Lori Moore is currently the director of compliance for ATTUS Technologies, Inc., and has over 23 years' experience in the financial services industry. During her career, she has gained an in-depth knowledge and practical experience within all areas of community banking and served in key positions including vice president of operations, BSA officer, compliance officer, internal audit, and vice president of risk management. Lori Moore was also designated as the Outstanding Graduate of Texas Bankers Association Operations School.