Can anyone share what enhanced due diligence they are doing or plan on doing for your customers that may be third party processors. We do not currently have any of these types of accounts and are trying to get a handle on what types of questions we should be asking at account opening and then how to proceed with account monitoring.

We don't have the accounts either... However, focus on the SOURCE of the funds that flow through the account.

Essentially you should be obtaining information on THEIR customers almost as much as you would if THEIR customers were YOUR customers... The whole risk spectrum for 3rd party processors is similar to Attorneys in that they can act as arms length intermediaries for thier customers/clients. You want to close down that arms length...

Since their may be some reluctance to turn over customer information to you... the next best thing is to get all the information you can about the transaction activity of the 3rd party processor, who their customers are, and clamp a whole bunch of monitoring controls on their activity so that you are constantly assessing the activity that is flowing in and out of the account... Keep an eye on changes in activity or patterns of activity which are hallmarks of fraud. Where possible, request the ability to audit THEIR information about customers annually and as necessary... especially if they are doing ACH, use NACHA rules to help you as much as BSA rules.

Hope that helps a little.

Cheers!

DGEND,

Maybe you can get some guidance from these publications.

Supervisory Insights

Third Party Payments

Thank you, this gives me something to work with.

I would suggest monitoring ACH charge-backs for potential TPPP activity.

For smaller community banks, it is probably extremely rare you would have a true TPPP. Examiners have been mis-interpreting the true definition of a TPPP.

As a BSA Officer, become involved in your ACH Origination (cash management) & RDC products/customers. This is where you'll catch one, IF (and I do mean if), you get a true TPPP.

Look at customers that can originate ACHs and create Remotely Created Checks. Then determine if they are the final end point, or simply a pass thru to the third party.