Has anyone developed policies, check lists or any risk matrix for RDC's yet?

We have an exam coming in Sept - So I will see if my logic survives. . .
This is a product - we don't have a policy for every new product that comes along (Internet Banking - Bill Pay - Phone Banking - Debit cards ) SO = we don't have a policy.
We do have
+ Risk Assessment ....+ Controls to Mitigate the Risks ........+ Underwriting Standards......+ Procedures ......+ Contract with the customer.......+ Audits of customers images / deposits & onsite visits with checklists

Thanks that sounds good. I'll try your logic!

Wait, I just noticed---deposits & onsite visits with checklists---who does your onsite visits? BSA or the person in Cash Mangement selling the product? Also what kind of checklists are you using? Will you share?

Onsite is done by the Cash Mgt Personnel.
Nothing majic about the onsite checklist
Are they retaining the orig checks / retaining for time specified in contract / are they retined in secure location / are they using login security levels appropriately / Is their p.c. up to date on Virus -MalWare etc. Protection / Are they properly maintaining the scanner to get good images / Is it properly "spraying" the check as presented electronically

Thanks

Banks that are starting small on RDC are usually focusing on current business customers in the bank's routine account-gathering territory. Site visits are probably the expected norm in such situations.

But don't forget that one of the big selling points (and risks) for RDC is that distance from the bank need not be a barrier. A bank in Boston could theoretically accept deposits via RDC from a customer in Sausalito, California. That might mean a change to a strict site visit requirement!

I'm going to encourage our Marketing Dept. to focus on potential business clients in Hawaii!!!

Yeah, I'm with you, we do have one RDC customer in San Antonio - about 6 hr. away and nice place to visit in the Fall, or when the River Walk is all lit up for Christmas. But I can't convience anyone that I need to do a Compliance visit.

As to John's post = Yes, our on-site visits are only for the customers in are area. A reason to be extra selectivie of customers outside our market.

Are you making these visits as a part of the annual audit of RDC? I did not visit our customers last year but am debating doing it this year.

Other local banks are not visiting.

My thoughts on the audit were similar to yours.....where are your originals, how are you destroying and when, where's your PC and how is it accessed?

How do you address it with the customer...do you have a sales guy from Cash Mgmt come with you?

Would you be willing to share any of the information you have develped. ie: risk assessment, customer monitoring, etc.

When you do the underwriting, who are you doing the credit reports on? The owner or the user's. Sometimes it's not the owners on the contract but an employee. Then I guess we should be doing an OFAC on all parties as well?

I'm sorry I mean sometimes it's not the owners who are User's they are just on the contract. Sometimes someone who isn't on the contract is the User.

We underwrite the business that is doing the depositing. All of these companies (to date anyway) already have a commercial lending relationship with our bank and we have financials and the like on file. Any additional exposure from RDC or any deposit feature is always noted on the annual review of the credit as a whole.

The contract itself is between the Bank and the Business. The signers of the contract are the owners of the Business or a designated officer on a corporation's resolution. Usually, the people utilizing the system are not the people that executed the contract. Their names appear on the page of the contract where the business authorizes certain people to use the RDC system. We also have them sign saying they were trained and are going to play by the rules we gave them. It's kind of like night drop - -the agreement is signed by the biz and then they have a couple of employees that make the deposits. We don't underwrite them , pull CBRs or anything - - - just train them. We don't OFAC them either....just the business. Does that help?

Yes, thank you.

With reference to the site visit comments, what alternatives come to mind for customers who are not geographically 'convenient'? I don't want to blanket code those customers as high risk, but I do feel they would need additional monitoring....thoughts?

As I said above, I haven't conducted site visits yet, so this is just in the thinking stages, but..... I'm thinking of sampling the locals and maybe adding in one or two less convenient stops if there is a way to put them in with another trip (conference travel, personal vacation time, etc)

Our cash management staff samples deposits from all customers to check for compliance with our agreement, but this really doesn't compensate for a lack of a visit from the auditor. I am in the early stages of considering an internal control-ish questionnaire for the customer to complete and return. It's not the same as being there, but it's the only thought I have right now.

Still haven't finalized the details on how to make a visit to the locals either.

Question - our marketing guy has asked the question concerning RDC and whether or not the deposits are considered "in person". the code on the depoist appears as if they had conducted the deposit at the bank. His line of questioning revolves around this - could someone write a check off of their MMDA everyday and deposit it via RDC into their DDA and it be okay under the excessive transactions rule? Would that be considered electronic or in-person? I don't think the regs have caught up with the technology yet.

I have been out of touch for a couple of days, so I will touch on the issues in previous posts.
Our onsite visits are conducted by our Cash Mgt / RDC personnel, who is a former IR Mgr and can make sure customer's p.c. is up to date on virus etc.
Underwriting - so far we have only existing customers, so we know them and look at their financials. IMO trying to check OFAC or run credit on a "user" is going too far. Applying the same logic as giving cash mgt or internet banking to a business = whoever they allow access is their decision, just like who they add as an authorized signer on an acct is their business.

Walden = I think you are right concerning a transaction code making it appear to be in person. I believe our system sees the deposit just as if it were ran by a teller. BUT our contract has a requirement that they can not deposit "their own checks", intneded to cover kiting but would apply for their own MMDA as well.

Is anyone willing to share their RDC policy?

Does anyone have a Remote Deposit Risk Assessment they could share? I don't know where to start.

I would like to see one too.

Ditto!

If anyone could PM me, I would like to see it too!

Thanks

Might be tough to solicit objective opinions here, but does anyone have any feedback (positive or negative) on the RDC Risk Assessment in the BOL Banker's Store (from Susan Orr). E-mail me offline if you prefer. Thanks!