FFIEC part 2 Flashcards by Jason Mendoza

What are the major topics that the manuals and/or booklets of the FFICE cover?

Retail Payments Systems

Bank Secrecy Act/Anti-Money Laundering Examination Manual

Information Security

Mobile Financial Services

Authentication and Access to Financial Institution Services and Systems

Supervisory Guidance for Remote Deposit Capture

Business Continuity Management

Interagency Guidance: Third Party Relationships

How well did you know this?

Not at all

Perfectly

What does FFIEC stand form?

Federal Financial Institutions Examination Council

How well did you know this?

Not at all

Perfectly

What does the FFIEC do?

Prescribes uniform principles, standards, and report forms for the federal examination of financial institutions for financial regulators.

Make recommendations to promote uniformity.

The FFIEC is not itself a regulation.

How well did you know this?

Not at all

Perfectly

What are the different governing bodies that the FFIEC provides unform priniciples and standards for?

Board of Governors of the Federal Reserve System (FRB)

Federal Deposit Insurance Corporation (FDIC)

National Credit Union Administration (NCUA)

Office of the Comptroller of the Currency (OCC)

State Liaison Committee (SLC)

Consumer Financial Protection Bureau (CFPB)

How well did you know this?

Not at all

Perfectly

How does the FFIEC make recommendations to promote uniformity in the supervision of financial institutions?

It does so through guidance designed to

Guide bank examiners during examination process; and
Assist financial institutions to:
Identify risks, and
Evaluate adequacy of controls and risk management practices

How well did you know this?

Not at all

Perfectly

What does the Retail Payment Systems - IT Examination Handbook provide?

Identifies and controls risks related to retail payment systems and other related banking activities.

How well did you know this?

Not at all

Perfectly

What are the 6 risks identifies by the FFIEC Retail Payment Systems handbook?

SCROLL

Strategic Risk
Credit Risk
Reputation Risk
Operational Risk
Legal/Compliance Risk
Liquidity Risk

How well did you know this?

Not at all

Perfectly

Summarize the different topics covered in the Retail Payment Systems IT Examination Boodk.

Know the FFIEC Guidance

Know Your Customer (KYC)

Establish appropriate risk-based guidelines for customers/vendor selection

Have strong agreements

Know and anticipate the risks with RDC

Legal/compliance risks
Reputational risks
Operational risks

Measure/monitor/review reports

Include senior management in reporting

Understand types of risk in retail payments and how to manage and monitor each

How well did you know this?

Not at all

Perfectly

What does the FFIEC warn regarding third paries?

They introduce new risks.

How well did you know this?

Not at all

Perfectly

What services do retail payment systems provide?

checks and share draft item processing

bankcards,

payment cards

ACH

EFT/POS networks

electronic bill payment

person to person (P2P) and A2A account to account payment systems

many others as technology advances…

How well did you know this?

Not at all

Perfectly

What shoudl the Examination Scope be based on?

the risk profile of the financial institution or the technology service provider

How well did you know this?

Not at all

Perfectly

What determines the risk profile?

an assessment of the entity’s risk environment and quality of risk management practices.

How well did you know this?

Not at all

Perfectly

What is the underlying Tier I Objective?

To evaluate the effectiveness of
the internal controls and risk
management processes
implemented by the financial
institution or service provider

How well did you know this?

Not at all

Perfectly

What is the underlying Tier II Objective?

To expand the scope of the
examination further if the risk
profile or complexity of the
organization requires additional
information

How well did you know this?

Not at all

Perfectly

List all of Tier I objectives

1 Assess the LEVEL of risk in retail payment systems function

2 ESTABLISH the SCOPE and OBJECTIVES of the examination of the retail payment systems functions.

3 Assess the QUALITY OF OVERSIGHT and support provided by the board of directors and management

4 Assess the QUALITY OF POLICIES, procedures and limits supporting retail payment services.

5 Assess QUALITY OF MANAGEMENT INFORMATION SYSTEMS and reports used to manage retail payment services

6 Assess the QUALITY OF RISK MANAGEMENT t and support for BANKCARD ISSUANCE and acquiring (merchant processing activity)

7 Assess the QUALITY OF RISK MANAGEMENT and support for EFT/POS PROCESSING

8 Assess the QUALITY OF RISK management and support for ACH PROCESSING activity.

9 Assess the QUALITY OF RISK MANAGEMENT AND SUPPORT for electronic banking related retail payment transaction processing.

10 Asses the QUALITY OR RISK MANAGEMENT and support for CHECKS

11 Assess the QUALITY OF RISK MANAGEMENT of new and emerging technologies.

How well did you know this?

Not at all

Perfectly

Describe Tier II Retail Payment Systems Examination Procedures.

The Tier II Retail Payment Systems Examination Procedures provide additional validation steps to verify the effectiveness of a financial institution’s internal control processes over ACH, EFT/POS network, check item, electronic banking-related retail payments, and bankcard processing, clearance, and settlement

How well did you know this?

Not at all

Perfectly

What does the BSA/AML Examination Manual provide?

Provides guidance on identifying and controlling risks associated with money laundering and terrorist financing

How well did you know this?

Not at all

Perfectly

What does the FFIEC BSA/AML Examination Manual include?

Suspicious Activity Reporting (SAR)

Currency Transaction Reporting

Correspondent Accounts (Foreign)

Automated Clearing House Transactions

Third-Party Payment Processors

What requirements must the BSA/AML compliance program provide?

Internal Controls
- policies, procedures
- regulatory updates
- incorporating dual controls and segregation of duties

Independent testing
- Conducted by bank personnel or by an outside party
- Testing to ensure the internal controls are aligned with the bank’s risk profile

BSA compliance officer
- Designation of an individual or individuals responsible for coordinating and monitoring day-to-day compliance

Training for appropriate personnel
- Should include examples of money laundering and suspicious activity monitoring and reporting
- Document training program

What are the BSA/AML: Money Laundering Steps

Placement

Layering

Integration

Placement

First and most vulnerable stage of laundering money

Goal is to introduce unlawful proceeds into the financial system without attracting attention of financial institutions or law enforcement

Layering

Second stage which involves moving funds around the financial system - often in complex series of transactions to create confusion and complicate the paper trail

Integration

Goal once funds are in the financial system and insulated through layering stage

Create the appearance of legality through additional transactions

The information technology examination handbook provides guidance to examiners for:

Assessing level of security risks

What do Information Security programs need?

Strong board and senior management support. Ability for institution's board/management to continually review as new threats, technologies, and business conditions arise.

What doe security issues arise from?

* Disclosure of information to unauthorized individuals * Unavailability or degradation of services * Misappropriation or theft of information or services * Modification or destruction of systems or information * Records that are not timely, accurate, complete, or consistent

What does Appendix E: MFS from April 20216 address?

MFS Technologies Risk Identification Risk Measurement Risk Mitigation Monitoring and Reporting

What doe MFS stand for?

Mobile Financial Services?

What is MFS?

Mobile financial services (MFS) are the products and services that a financial institution provides to its customers through mobile devices.

What are SMS?

SMS technology are messages transmitted unencrypted over widely used telecommunications.

What are SMS risks?

vulnerable to spoofing may mislead customers into revealing financial institution account information .

What is Authentication and Access to Financial Institution Services and Systems?

It provides examples of effective risk management principles for access and authentication Acknowledges risks with cybersecurity threat landscape and reinforces need to effectively authenticate user.

Name the separate sections of the What is Authentication and Access to Financial Institution Services and Systems manual.

Guidance threat landscape Risk assessment Layered security Multi-factor authentication as part of layered security Monitoring, logging, reporting email systems and internet browsers call center and IT help desk authentication Data aggregators User awareness and education Customer and user identification

What does the RDC Risk Management manual outline?

Outlines considerations for identifying and assessing new transaction delivery system risks.

What should senior management understand prior to implementing RDC services?

Identify and assess the legal, compliance, reputation, and operational risks associated with new system Ensure RDC is compatible with institution’s business strategies Understand return on investment Understand ability to manage the risks inherent in RDC

Describe the supervisory guidance of RDC.

Agreements KYC customer Due Diligence/suitability Vendor Due Diligence - Ensure sound vendor management processes. Business continuity - ensure ability to recover disruption Information Security - security of nonpublic records Separation of duties RDC training for customers Measure and monitor activities review and operational risk management File monitoring customer monitoring to ensure customer is in compliance with operational risks Performance measuring management - reporting to management and board, transaction reporting of errors, duplicates, rejects, etc.

What should RDC agreements entail?

Roles and responsibilities of all parties types of items allowed governing laws, regulations and rules such as funds availability policy, collateral, warranty claims for encoding erros and indemnity claims Such also include customer consideterations technology eligibility security and retention requirements for original items Repair considerations: accurately represent MICR

What are the conditions required for the RDC Indemnity to apply?

Paper bank suffers a loss presence of restrictive endorsement on original checks inconsistent with the means of deposit (for example: for mobile deposit only)

What risks does the RDC Indemnity bring?

Indemnity places risk of multiple deposits of same item on remote deposit capture RDC Bank provides indemnity under certain conditions for duplicate presentments of the RDC check.

What other risks does the RDC indemnity bring, in regard to restrictive endorsements?

Does the agreement require restrictive endorsements? Are reviews conducted to verity presence of restrictive endorsements. Are there procedures for the RDC indemnity claim process to both make a claim or disclaim a claim? - is staff educated on process - are disclaim processes understood?

What are retail payment systems?

* Identify and control risks associated with retail payment systems and related banking activities *Mobile payments discussed in section on Emerging Retail Payment Technologies *Numerous terms defined in Glossary (Appendix B) for mobile/online payments

What does retail payment systems include oversight over?

*Check-based payments (RCCs, ECI, RDC, etc.) *ACH network *Card-based electronic payments *Emerging retail payment technologies