Skip to content
BOL Conferences Top Gun 23
Thread Options
#1916845 - 04/23/14 05:16 PM Consumer Online Banking Sub-User Access
AnnRoy Offline
Platinum Poster
AnnRoy
Joined: Jun 2002
Posts: 771
South
Our bank recently rolled out sub-user access for consumer online banking. My understandingis the primary user has the ability to authorize another person(s) with access to their online banking with limited access. Shared access may include view-only, ability to make transfers, and initiate payments. Certain restrictions may also be placed on that access such as dollar limits. The sub-user will have their own credentials and the primary account holders assumes all liability for the activity.

Disadvantages - No CIP conducted on the sub-user and the customer information on the sub-user will not be maintained on the bank's core. We will have the ability to monitor the account itself but no way to know who is actually using the account. Also there's an issue that a personal account may be set up but actually be used for a business purpose.

Q - what, if any BSA issues/risks to address? Has anyone conducted a risk assessment?
_________________________
CAMS

Return to Top
BSA/AML/CIP/OFAC Forum
#1916878 - 04/23/14 05:59 PM Re: Consumer Online Banking Sub-User Access AnnRoy
John Burnett Offline
10K Club
John Burnett
Joined: Oct 2000
Posts: 39,858
Cape Cod
I think you've hit on the biggest BSA concern -- not knowing who's using the account. Theoretically, with the right access levels, "Mystery Man 1" could enjoy most of the privileges of account ownership and none of the responsibilities. Taking it to an extreme, "Mystery Man 1" could be on OFAC's SDN list.

Ask yourself whether there's a legit market for this kind of access.
_________________________
John S. Burnett
BankersOnline.com
Fighting for Compliance since 1976
Bankers' Threads User #8

Return to Top
#1917273 - 04/24/14 05:39 PM Re: Consumer Online Banking Sub-User Access John Burnett
AnnRoy Offline
Platinum Poster
AnnRoy
Joined: Jun 2002
Posts: 771
South
Well John,

As most BSA Officers will tell you, BSA was not involved in the decision and it's a done deal - rolled out in March 2014.
_________________________
CAMS

Return to Top
#1917282 - 04/24/14 05:53 PM Re: Consumer Online Banking Sub-User Access AnnRoy
RockChucker, CAMS Offline
Diamond Poster
Joined: Jul 2013
Posts: 1,691
The Country
Can you "unroll" it?

Done deals can usually be undone. Especially important if they are foolish ones
Last edited by RockChucker; 04/24/14 06:11 PM. Reason: Clarification
_________________________
A successful man is one who can lay a firm foundation with the bricks others have thrown at him.
-David Brinkley

Return to Top
#1917296 - 04/24/14 06:06 PM Re: Consumer Online Banking Sub-User Access AnnRoy
HappyGilmore Offline
10K Club
Joined: Jun 2004
Posts: 19,602
Pulling people out of the ditc...
what will you do when your customer says "i withdrew his access on X date, these $50,000 in transfers are not authroized, give me my money back."

I see no valid reason that consumer account access would be given to anyone not on the account.
_________________________
Providing alternative truths since the invention of time

Return to Top
#1917312 - 04/24/14 06:28 PM Re: Consumer Online Banking Sub-User Access AnnRoy
JacF Offline

Power Poster
Joined: Nov 2001
Posts: 6,719
PA
I suspect we have the same online banking platform provider, as this functionality was just added to our consumer offerings as well. Fortunately, management saw the risks and decided to turn this feature off until we can properly evaluate it.

We have this functionality in our business banking application, and the appropriate controls and liabilities written into our business banking agreement. Our consumer agreement contains no such provision, because it did not presuppose this functionality.

I agree with John that the risk of inviting ghost customers is a big BSA concern, as well as a security/fraud concern. We already have to deal with people who don't qualify for accounts (or who choose not to open accounts because they are riddled with judgments) having direct deposits, etc. routed to friends' and family members' accounts. This type of functionality makes it even easier for these higher risk customers to access the banking system without being properly vetted.

Do you have many customers using this feature? If so, could you reach out to them and see if there is a better way for them to achieve whatever purpose they are trying to achieve by adding sub-users?

Return to Top
#1917352 - 04/24/14 07:17 PM Re: Consumer Online Banking Sub-User Access AnnRoy
ACHguru125 Offline
New Poster
Joined: Nov 2013
Posts: 18
Our vendor recently added "shared access" to our consumer platform as well, but my research shows it should be part of a "small business suite" that will later come with ACH/WIRE transfer capabilities... I was under the impression when this first hit our radar that we would have control over who had "shared access" capability, which would give us an opportunity to monetize the ACH/WIRE functions and shared access functions, but also provide certain agreements etc.

Of course we now have no control whatsoever, and it is available to ALL consumer customers.

Return to Top
#1917355 - 04/24/14 07:19 PM Re: Consumer Online Banking Sub-User Access AnnRoy
Another Day Offline
New Poster
Joined: Oct 2006
Posts: 14
GA
As a test, someone in our institution added a known terrorist's name (as well as Porky Pig) to their account at another financial institution with this functionality.... no one called with any concern.

Return to Top
#1917361 - 04/24/14 07:30 PM Re: Consumer Online Banking Sub-User Access AnnRoy
John Burnett Offline
10K Club
John Burnett
Joined: Oct 2000
Posts: 39,858
Cape Cod
A consistent theme running through this thread is the idea that a vendor has apparently presented its client bank with a fair accompli, and made it accessible by customers without adequate opportunity for the bank to review the "enhancements" and determine whether they are appropriate or needed. If that's not a case of the tail wagging the dog, I don't know what it.

The banks need to retake control. The vendor works for them, not the other way around. And that will require having good vendor management practices.
_________________________
John S. Burnett
BankersOnline.com
Fighting for Compliance since 1976
Bankers' Threads User #8

Return to Top
#1917366 - 04/24/14 07:37 PM Re: Consumer Online Banking Sub-User Access AnnRoy
Kathleen O. Blanchard Offline

10K Club
Kathleen O. Blanchard
Joined: Dec 2000
Posts: 21,292
Amen.
_________________________
Kathleen O. Blanchard, CRCM "Kaybee"
HMDA/CRA Training/Consulting/Mapping
The HMDA Academy
www.kaybeescomplianceinsights.com

Return to Top
#1917379 - 04/24/14 07:58 PM Re: Consumer Online Banking Sub-User Access AnnRoy
HappyGilmore Offline
10K Club
Joined: Jun 2004
Posts: 19,602
Pulling people out of the ditc...
John - since the OP reports that "the bank rolled out" i took this to mean that someone in the bank thought this was a good idea, and rather than perform the proper vetting across various lines of business (including risk, complinace, etc), made a somewhat unilateral decision to do this. Not that the vendor just did this on their own.

So the question at this point is how far down the road is the bank, what is the acceptance level, what impact to customers if it is retracted, and what mitigation has the bank put in to address issues?
_________________________
Providing alternative truths since the invention of time

Return to Top
#1917382 - 04/24/14 08:03 PM Re: Consumer Online Banking Sub-User Access AnnRoy
Kathleen O. Blanchard Offline

10K Club
Kathleen O. Blanchard
Joined: Dec 2000
Posts: 21,292
I think John's comment relates more to subsequent posters, rather than the initial, where this seems to be a "push" product.
_________________________
Kathleen O. Blanchard, CRCM "Kaybee"
HMDA/CRA Training/Consulting/Mapping
The HMDA Academy
www.kaybeescomplianceinsights.com

Return to Top
#1917413 - 04/24/14 08:40 PM Re: Consumer Online Banking Sub-User Access AnnRoy
JacF Offline

Power Poster
Joined: Nov 2001
Posts: 6,719
PA
The bank could still be behind the product and unwilling to turn it off, even if it was a vendor initiated change.

Return to Top
#1917414 - 04/24/14 08:40 PM Re: Consumer Online Banking Sub-User Access HappyGilmore
John Burnett Offline
10K Club
John Burnett
Joined: Oct 2000
Posts: 39,858
Cape Cod
Originally Posted By: HappyGilmore
John - since the OP reports that "the bank rolled out" i took this to mean that someone in the bank thought this was a good idea, and rather than perform the proper vetting across various lines of business (including risk, compliance, etc), made a somewhat unilateral decision to do this. Not that the vendor just did this on their own.

So the question at this point is how far down the road is the bank, what is the acceptance level, what impact to customers if it is retracted, and what mitigation has the bank put in to address issues?
I agree with you, Happy. And, as suggested, I was focusing on some of the later comments suggesting that other banks had slightly different problems, but with a common genesis -- a feature offered by the vendor.

As to the OP, I'd suggest that the right people weren't involved in deciding to implement this feature. But that is just my opinion. I think that at this point the first thing to determine is how many customers have actually used the feature. If it's 3 customers, I'd pull the plug on it a whole lost faster than if there are 300.
_________________________
John S. Burnett
BankersOnline.com
Fighting for Compliance since 1976
Bankers' Threads User #8

Return to Top
#1918225 - 04/28/14 08:25 PM Re: Consumer Online Banking Sub-User Access AnnRoy
downbytheriver Offline
Member
Joined: Jan 2008
Posts: 51
Georgia
I reached out to my regulator on this topic and it took over a month to get a response. They came back with the stance that this service will be considered high risk, should be part of individual customer risk ratings, and would prefer that customers utilize a Power of Attorney in order to obtain access to the customer's account. Our bank also rolled out this feature without the knowledge of the compliance area.

The regulator feels that this service "invites" customers to perpetuate fraud and goes against the "know your customer" policies and "beneficial ownership". We only have a handful of customers utilzing the service at this time. We have pushed back out our concerns to executive management but have yet to hear back from them on whether this service will continue to be offered. I can only hope that they do the right thing.

Return to Top
#1918322 - 04/29/14 01:49 PM Re: Consumer Online Banking Sub-User Access AnnRoy
banker1976 Offline
Gold Star
Joined: Nov 2005
Posts: 346
Mid-Atlantic
We recently rolled this out as well, within that past two months, and as with many things, the BSA department was not aware that this would be happening; how BSA became aware of it was the senior BSA Officer happened just by chance to be in a meeting in which the topic was ever so briefly mentioned, as if a casual no-big-deal offering to customers.
_________________________
CAMS
CAFP

Return to Top

Moderator:  Andy_Z