Our bank recently rolled out sub-user access for consumer online banking. My understandingis the primary user has the ability to authorize another person(s) with access to their online banking with limited access. Shared access may include view-only, ability to make transfers, and initiate payments. Certain restrictions may also be placed on that access such as dollar limits. The sub-user will have their own credentials and the primary account holders assumes all liability for the activity.

Disadvantages - No CIP conducted on the sub-user and the customer information on the sub-user will not be maintained on the bank's core. We will have the ability to monitor the account itself but no way to know who is actually using the account. Also there's an issue that a personal account may be set up but actually be used for a business purpose.

Q - what, if any BSA issues/risks to address? Has anyone conducted a risk assessment?

I think you've hit on the biggest BSA concern -- not knowing who's using the account. Theoretically, with the right access levels, "Mystery Man 1" could enjoy most of the privileges of account ownership and none of the responsibilities. Taking it to an extreme, "Mystery Man 1" could be on OFAC's SDN list.

Ask yourself whether there's a legit market for this kind of access.

Well John,

As most BSA Officers will tell you, BSA was not involved in the decision and it's a done deal - rolled out in March 2014.

Can you "unroll" it?

Done deals can usually be undone. Especially important if they are foolish ones

what will you do when your customer says "i withdrew his access on X date, these $50,000 in transfers are not authroized, give me my money back."

I see no valid reason that consumer account access would be given to anyone not on the account.

I suspect we have the same online banking platform provider, as this functionality was just added to our consumer offerings as well. Fortunately, management saw the risks and decided to turn this feature off until we can properly evaluate it.

We have this functionality in our business banking application, and the appropriate controls and liabilities written into our business banking agreement. Our consumer agreement contains no such provision, because it did not presuppose this functionality.

I agree with John that the risk of inviting ghost customers is a big BSA concern, as well as a security/fraud concern. We already have to deal with people who don't qualify for accounts (or who choose not to open accounts because they are riddled with judgments) having direct deposits, etc. routed to friends' and family members' accounts. This type of functionality makes it even easier for these higher risk customers to access the banking system without being properly vetted.

Do you have many customers using this feature? If so, could you reach out to them and see if there is a better way for them to achieve whatever purpose they are trying to achieve by adding sub-users?

Our vendor recently added "shared access" to our consumer platform as well, but my research shows it should be part of a "small business suite" that will later come with ACH/WIRE transfer capabilities... I was under the impression when this first hit our radar that we would have control over who had "shared access" capability, which would give us an opportunity to monetize the ACH/WIRE functions and shared access functions, but also provide certain agreements etc.

Of course we now have no control whatsoever, and it is available to ALL consumer customers.

As a test, someone in our institution added a known terrorist's name (as well as Porky Pig) to their account at another financial institution with this functionality.... no one called with any concern.

A consistent theme running through this thread is the idea that a vendor has apparently presented its client bank with a fair accompli, and made it accessible by customers without adequate opportunity for the bank to review the "enhancements" and determine whether they are appropriate or needed. If that's not a case of the tail wagging the dog, I don't know what it.

The banks need to retake control. The vendor works for them, not the other way around. And that will require having good vendor management practices.

Amen.

John - since the OP reports that "the bank rolled out" i took this to mean that someone in the bank thought this was a good idea, and rather than perform the proper vetting across various lines of business (including risk, complinace, etc), made a somewhat unilateral decision to do this. Not that the vendor just did this on their own.

So the question at this point is how far down the road is the bank, what is the acceptance level, what impact to customers if it is retracted, and what mitigation has the bank put in to address issues?

I think John's comment relates more to subsequent posters, rather than the initial, where this seems to be a "push" product.

The bank could still be behind the product and unwilling to turn it off, even if it was a vendor initiated change.

I agree with you, Happy. And, as suggested, I was focusing on some of the later comments suggesting that other banks had slightly different problems, but with a common genesis -- a feature offered by the vendor.

As to the OP, I'd suggest that the right people weren't involved in deciding to implement this feature. But that is just my opinion. I think that at this point the first thing to determine is how many customers have actually used the feature. If it's 3 customers, I'd pull the plug on it a whole lost faster than if there are 300.

I reached out to my regulator on this topic and it took over a month to get a response. They came back with the stance that this service will be considered high risk, should be part of individual customer risk ratings, and would prefer that customers utilize a Power of Attorney in order to obtain access to the customer's account. Our bank also rolled out this feature without the knowledge of the compliance area.

The regulator feels that this service "invites" customers to perpetuate fraud and goes against the "know your customer" policies and "beneficial ownership". We only have a handful of customers utilzing the service at this time. We have pushed back out our concerns to executive management but have yet to hear back from them on whether this service will continue to be offered. I can only hope that they do the right thing.

We recently rolled this out as well, within that past two months, and as with many things, the BSA department was not aware that this would be happening; how BSA became aware of it was the senior BSA Officer happened just by chance to be in a meeting in which the topic was ever so briefly mentioned, as if a casual no-big-deal offering to customers.