Compliance Advisor

Question: Are we required to provide annual ACH reports to the bank’s board of directors?

Answer: There is certainly a regulatory expectation that the board (or a committee of the board) be ‘periodically’ informed of the bank’s ACH activity. Both the board of directors and management are responsible for ensuring that the ACH program does not expose the bank to excessive risk. The board's role is to establish the bank's overall business strategy and risk limits for the ACH program and to oversee management's implementation of the program. Managing that risk includes an ongoing process for reporting on the risk parameters established by the board of directors.

Below is from the OCC’s Automated Clearing House Activities: Risk Management Guidance originally issued in 2006 and was updated in 2013. Although this is an OCC ‘source,’ the various agencies take the same position.

…snip

Purpose

This bulletin provides guidance for national banks and examiners on managing the risks of automated clearing house (ACH) activity. National banks may be exposed to a variety of risks when originating, receiving, or processing ACH transactions, or outsourcing these activities to a third party. This bulletin outlines the key components of an effective ACH risk management program. Each bank should use this guidance to develop an ACH risk management program that reflects the nature and complexity of the bank's activities.

…snip

Reporting to the Board of Directors

To oversee management's execution of the ACH program effectively, the board of directors, or a committee thereof, should receive periodic reports that allow the board to determine whether ACH activities remain within board-established risk parameters and are achieving expected financial results. Such reports generally include:

• Metrics and trend analyses on ACH volume, returns, operational losses, and transaction types, with explanations for variances from prior reports;
• Metrics and trend analyses related to the composition of the bank's portfolio of originators and, as applicable, third-party senders;
• Capital adequacy relative to the volume of ACH activity and the level of risk associated with originators;
• The percentage of the deposit base that is linked to ACH origination activity;
• A summary of return rates by originator, and, as applicable, third-party senders; ⁴
• Unauthorized returns that exceed board-established thresholds;
• Notices of potential and actual rules violations and fines by NACHA;
• Financial reports on profitability of the ACH function as a cost center; and
• Risk management reports, including a comparison of actual performance to approved risk parameters.

Source link.

Capitol Comments

Click for Capitol Comments!