We are a very small community bank. Management wants us to look into allowing online acct opening and possibly loan applications on line. They want us to come up with the Pros & Cons

I am somewhat familiar with the requirements of E-Sign. However, I have concerns about CIP, ID Theft, OFAC, increase fraud and international applications, etc...

Where would you recommend we start our research?

Open an account at a Bank that offers on-line opening to see every step of they process they do. I did that when I was researching it years ago and it was very helpful.

Good idea. Also, speak with companies that offer online new account support services (ID theft, CIP, etc.). It can be very eye opening as to types of issues to expect and tools available to mitigate your risk.

I think CIP is a huge hurdle. I'd be interested to hear how this turns out for you so I hope you update this thread.

I also believe a banks appetite for risk will be a big part in how this is implemented.

I would never attempt to implement without a third party supporting the online CIP verification through a non-documentary verification database. I think it would be a nightmare.

It looks like I will be working on implementing this early next year.

I will post what I come up as this moves forward. I am also looking for any suggestions that people have.

I am still collecting info... Not much compliance issue help yet...
I have visited large bank sites to see what they ask for. I have discovered they are asking for the normal stuff we ask for now, manually. However, what I don’t know and those bank websites don’t tell me is, how do they VERIFY??

They ask for DL number, BOD, SSN… But, how do they know that this data belongs to the person applying/opening the account?
They would have to have a process to subject the data collected to an automated verification system. They would have to feed the data into a system like BAM or one of the BSA systems.

Without such a system, I see no way to comply with BSA when opening accts online.

We do not pull credit reports on DDA openings. Most of the comments I have read regarding risk mitigation for non-documentary online acct opening is… “Pull Credit Report to verify data”. I have discovered during our ID Theft Red Flag procedure set up, credit reports have a lot of JUNK on them and IMO are hardly reliable primary sources of identity verification.

I also have concerns about persons out-of-country opening accounts. We would have to verify addresses to make sure that some one in North Korea didn’t give a Milwaukee address as they attempt to open an account?

I have a lot of unanswered questions.

Credit reports are are an often relied upon source. Shooting holes in that would really cause concern.

My fear is that some banks will dip their toes in the water and pull it out only when they have excessive losses. Unfortunately their pool of polluted accounts may cause even more concern if the losses are not initially felt.

Diputs . . . we open accounts on line. Our system is set up to ask them a series of four questions (which only they should know the answer to). These questions are derived from their credit report. Their identifying information (SSN, birthdate, DL#, etc.) is also run through a program similar to Chexsystems. I believe the company that performs these checks also has access to DMV records to verify DL#. The company we use is EFunds. We have not had any issues with verifying information this way.

In some instances, the person applying will not remember information from their credit report( could be info from as far back as 5 years). In that case, they will not pass and not be allowed to open the account online. However, they can call us and we can ask them different questions (again, from the credit report) to verify identity that way also. The questions are supplied to us by the account opening program. However, if any of the CIP requirements (name, DOB, SSN, address) do not match then the account will not be opened.

Currently, my main issue is verifying the DL. I have been told by our legal dept. That our state has a policy to not release DMV records to anyone. Thus a vendor would not be able to access the data for us.
Our Telecheck can only access data bases that are a result of reported and compiled info that has been reported by other institutions & merchants.
IMO, this would be an unacceptably high risk situation. I would not feel comfortable with that sort of verification.
Credit reports could be an option, however, right now we only use them as a supplement to photo or govt issued IDs. We do not deal with credit cards apps in a non-face-to-face transaction so, we have not incorporated the credit report exception into our CIP process as a “primary” ID source.

I have a BSA “risk” concern that I am struggling with mitigating…!