As FedNow® and RTP® continue to grow, ePayAdvisors’ Crissy Terry and Amber Schweiger visit The Payments Space to share insights into the value of audits and risk assessments for instant payments, common findings in these engagements, and the impact of the discontinuation of the Zelle standalone app.

00:21

This is Anne-Marie Leake, Vice President communications for ePayResources.

Welcome to The Payment Space. I'm delighted to welcome Chrissy Terry and Amber Schweiger from ePay Advisors back to the Payment Space.

Thank you for having us again, Anne Marie.

Well, thank you for being here. You guys are just doing such a tremendous job sharing all this great information with our members. As we discussed in our last episode together, ePay Advisors now offers FedNow audits as well as an instant payments risk assessment.

And the RTP audit has been offered for a few years now. So, I appreciate you joining us to dive deeper into these services. Let's start with some of the findings that you all are noting while conducting these particular audits and risk assessments.

There was an overarching theme that we noted across the board for all services. And while some of these are not required by the rules of the service, from a risk and internal control perspective, they are vital to ensure the health of the program and a key element of maintaining alignment between the board of directors, upper management and staff.

Yeah, so there were really three main themes when we were identifying findings as we conducted the audits and risk assessments specific to FedNow and RTP. And the first one was reporting to the Board of Directors.

The second was instant payment policies. And then procedures were also a common finding.

So, taking a little bit of a deeper dive to the reporting for the Board of Directors. In many cases, this just wasn't implemented. You know, it's really important to make sure that the Board of Directors are up to date on the health of any payment rail. And the best way to really do this is through reporting.

It allows the Board of Directors to make decisions and to set policy for the direction of that specific payment rail. Now, in regards to an instant payment policy or really just an overall payments policy, we noted that that was missing in many cases.

A well-defined policy establishes the framework for the financial institutions, processes, procedures, products, and serves as a benchmark for the Board of Directors approved risk parameters. And so, ensuring that you have policies in place really help make sure that that direction is clearly set for staff to understand the risk appetite of the organization.

And then finally, procedures. We all know how important procedures are to an institution. We want to make sure that the procedures aligned with policy, but also it serves to help staff have a clear direction on operations. Personally, IDEA procedures is a critical aspect in any function of the financial institution. I think we've all had situations where we have an employee who is that SME, right, the subject matter expert, and they know all the things, and so maybe there aren't very clear procedures.

But sadly, there are cases where that employee may suddenly not be available and in those cases procedures really help ensure the institution is able to continue with their operations and that staff is aware of the expectations and how to conduct those operations without the issues without that SME being available.

Yes, that is so important and that that is a great overview and knowing you guys like I do, I know you probably have some more specific detail we can drill down into on these findings.

Yeah, absolutely. So talking first about the Board of Director Reporting, so oftentimes we're asked, you know, well, what should that reporting really look like? And so, it really does need to be those key metrics, so volumes.

When we're talking about RTP and FedNow, many of our institutions we work with say, well, we're a receive-only. You know, what do we really need to report? Well, you need to report just that. Just how many received transactions are you accepting?

Do you have any reports of fraud? And from a sending perspective, obviously also send volumes, but are you taking any losses? Are you having reports of fraud from the, you know, your consumer base? Also reporting any income. Obviously, that can help offset some losses. So, income is an important aspect if you choose to charge for these services.

Downtime is another thing we look for. There are specific requirements in the rules for uptime and so being able to report that you've had no downtime or very minimal downtime in your board of director reporting helps ensure that the board knows that your service is running as expected. And then finally, if you've had any rules violations, so has the clearinghouse or the FED reached out to you to let you know that you are violating a rule. The board should know about that. And then what that action plan is to correct.

And so, we also noted that procedures are either missing or incomplete. And this would include handling of reported fraud. And reports of abuse or errors. Incidentally, the reporting of these topics is within the rules. So, procedures documenting the process are important.

And procedures, even if an FI is receive-only, they need to be developed for handling reports of fraud or abuse. Like I said, you could have a money mule that needs to be identified. Also procedures need to be developed for erroneous and unauthorized payments.

Yeah, Amber, I’ve talked to so many of our financial institutions that we conduct these audits for and when I talk about procedures with them they're like but we're receive-only you know what do we need to have procedures on and I think you really hit the nail on the head especially when it comes to handling reports of fraud because you know it's

always good to have procedures in place prior to the event occurring so that you're not scrambling at the last minute in an emergency state trying to figure out how to handle something.

So, moving on to recommendations for a policy. So a policy that contains guidance from our board of directors for staff that includes the approved activity level such as if the financial institution is going to be receive-only or are they going to also offer the sending capability.

Now we're really focused on instant payments on this podcast, but I do want to mention it is a best practice to have a policy on all payments channels. So, everything from wires to mobile deposit to merchant remote deposit capture, there really should be a policy in place because it does set that mindset of where the board of directors approval is from a risk perspective.

Also, from a side note, there are many FIs that are receive-only and really should explore plans to send. So, I've talked to lots of financial institutions, and I ask them, you know, why are you receive-only with no plans to become a sender in the near future?

And the response I get every time is fear. They are scared of the additional losses and the risk that they would be taking because as you all know, once the entry is sent, it's irrevocable and it's instant.

Thanks, Chrissy. I know we're focusing on the audit and risk assessment findings, but I just wanted to note that if institutions need assistance developing these policies, that that's something that ePay advisors can help with, right?

Absolutely. Our consulting arm really does anything customized consulting. And so oftentimes we'll get asked, hey, we've got a policy developed, can you just take a look and make sure it includes all the things necessary. So that is certainly something that we are more than happy to assist with.

Great, thank you.

And just to go back to the common finding specific for one last topic, we did note that monitoring and reporting were in short supply.

So, while many of our audits were for receive-only FIs, the rules still do require monitoring and reporting specifically for continuous operation, which there's been a little confusion around that because a lot of the processors are monitoring the continuous operation of their product.

But the FI specifically does have that requirement to also monitor their continuous operation.

They also weren't monitoring or reporting for funds availability or fraudulent activity.

Thank you, Amber. That is really helpful to remind our members how important monitoring and reporting are in the overall compliance process.

Now, moving on to the hot topic of instant payments adoption, generally speaking, are you seeing more institutions getting on instant payments rails?

So yeah, we actually are, but unfortunately, as we stated before, we are seeing most of these FIs as receive-only

Yeah, that's absolutely correct, Amber. And again, I think, you know, there's very little risk to becoming a receive-only for FedNow or RTP. You know, I understand that the risk associated with sending is scary.

There are controls, though, that you can implement from a sending perspective. So, while the limits are high for receive, you know, for the networks, FedNow limits at 500,000, likely going to increase eventually.

And RTP increased their limit to 10 million as of February 9th, I believe. And so, you know, I think a lot of institutions don't realize that they have the ability to set limits from a send perspective.

So, you know, there are definitely opportunities to become a Sending institution while still mitigating your risk.

Another thing to consider is partnering with a vendor who can offer biometric capability and the ability to stop access to money movement at that point of entry. That really is an additional layer to help mitigate the losses due to fraud.

And I completely agree with you. There is that misconception in the industry that the limits have to be the same for send and receive. That also holds true for availability. ,

Oh, yeah absolutely, you know, everybody knows you think about FedNow and RTP and you think, oh, it's 24 by 7 by 365. Well, as a sending institution, you do not have to offer the sending functionality 24 by 7 by 365. You certainly do from a receive perspective, but from sending, you do not.

Now, the flip side to that is the customer experience, right? So, if I want to send my son, you know, $500 at 2am because he's broke down inside the road and he needs to pay the tow truck driver. And my financial institution has put restrictions on the time frames that I can send, that's not going to be a very good customer experience.

So, like any payment channel, it really is about balancing the risk with reward, that customer experience versus, you know, the risk of loss due to fraud.

Just as a quick side note, we are currently developing an instant payment series on the current state of instant payments and what the industry is experiencing, such as fraud trends, challenges to onboarding, etc.

So, be on the lookout for that in our education calendar. We will absolutely communicate that date and time when it is available.

And for right now, we have several resources in ePayU. So, if you guys are a current member, make sure to check out what we offer.

Absolutely. There's a lot of great resources out there. Another current hot topic, what do you think the impact will be to the industry of the Zelle standalone app going away?

So, I also wonder if financial institutions are considering that impact of the Zelle standalone app being sun downed in March.

What this is going to do is it's going to take the ability for customers to move money at any time to anybody to customers whose financial institution offers Zelle as a product.

So, new users were no longer able to enroll in the Zelle standalone app after January 8th of this year and existing users were no longer able to send or receive money using that Zelle standalone app after March 31st.

Yeah, I mean, Anne-Marie, I'm really glad that you brought up this topic and Amber, thanks for sharing those dates. And I think it's important to note this has already happened.

The impact is here, January 8th, new users not allowed to use the standalone app, not available.

For financial institutions listening to this podcast, I'm certainly hoping that you've considered the impact to your customer base. If you haven't, you

most certainly should be, you know, really evaluating how many of your customers are using that

Zelle standalone app. And then identifying how you could potentially help solve the gap if you're not currently a Zelle bank. And so, you know, FedNow and RTP really are additional solutions. I'm a firm believer in “options are great.”

So, I'm not trying to steer anyone away from using Zelle, but options are great from a price point perspective and from a limits perspective. So, I think this is a good topic we’ve brought up and financial institutions should certainly be evaluating the FedNow RTP service.

That’s right, because if not, there will be a need from the customer that could possibly be fulfilled by another financial institution that offers these other options.

So, if a financial institution needs guidance for onboarding FedNow or RTP, what can ePay Advisors do to help them?

Well, we talked about our consulting services a little bit already from a policy perspective. So, our consulting services really are completely customizable.

We can help with the instant payment readiness. We can also help, you know, we've done consulting just sitting in with vendors and making sure the right questions are being asked,

especially making sure that fraud components from a SIN perspective isn't forgotten about. We also talked a lot about Zelle. We offer a Zelle audit, so just a side note there, not really consulting specific. But we can also look at your payments landscape.

So, as we think about the Zelle impact and understanding your consumer's behavior, that is something that we can help assist you with.

And if you're interested in any of these services or learning any more, you can contact us at info@epadvisors.com.

Chrissy and Amber, you and your team truly are trusted experts that can help protect and grow financial institutions' payments business. Thank you again for sharing your expertise with us.

Thank you for having us!