Hi,
My Bank currently has a manual monitoring system in place which has resulted in excellent audits/exams but we are getting ready to implement an automated system. Does anyone have any tips for us to consider (maybe some that you may have had to learn the hard way) and/or any questions that you wish you would have thought about asking before implementation? Or, did something happen during or after your recent implementation that you wish you would have known about beforehand?

We have FIS IBS Insight as our core processor and should be implementing Verafin later in the year. We plan to go and visit another financial institution similar to our size that utilizes Verafin before our implementation but wanted a little insight on questions we should ask that we may not have thought about.

Thanks for any help that can be provided.

Hi April,

First, you might want to look at the types of data you want to pass to the monitoring system and determine if any cleanup efforts should be made before passing the data to the system (garbage in/garbage out).

Document, document, document!

Make sure you document decisions on how transactions are mapped, what transactions are going to be passed to the monitoring systems vs what transactions will not be passed (document rationale for why certain types will not be passed to the monitoring system), what controls are in place to ensure completeness and accuracy of the file transfer, etc. Document testing scenarios and results.

Log all questions to and responses received from the vendor.

Those are a few things that I can remember.

System validation from someone other than the vendor.

Thank you for the information. I will make sure I remember to do that when the time comes to implement.

We are an FIS IBS (for another month anyway) bank using Verafin. If you have any questions or want to talk about implementation, please send me a PM, I'd be happy to help if I can.

Good recommendations noted above.

Documentation of the implementation process and your methodology for setting rule thresholds and customer risk scoring factors is essential. Regulators and auditors will be looking for this documentation during exams/audits.

Ask the other bank if they have identified any monitoring gaps - transactions that the system does not capture or does not effectively monitor. examples would be IAT ACH, Foreign Wires, Loans, Letters of Credit, prepaid cards etc. Even if you do not have some of the products now, you may find you bank adding new products down the road.

Independent validation of the system will be required. You may want to begin the RFP process for that soon. You will want the validation to be performed about 6 months after going into production with your system. This will allow enough time to build sufficient data to test during the validation. Also make sure your validation includes Rule Tuning & Optimization and, if you are using the customer risk scoring part of the system, validation of the Customer Risk Scoring model.

Also regarding validations, cheaper is not always good. I have seen a couple of these rejected by examiners and had to be redone by another third party.

One thing many banks do not know is that there are some firms who have specialists that can assist the bank with the system implementation process. Many times we feel that the vendor knows what they are doing and will set it up properly. This is far from the truth. They will install based on defaults and leave it up to you to do the rest. Since each bank is different, the defaults will not provide you with an efficient system. You will not have enough knowledge of the system to do this effectively. It will cost some money, but well worth it.

One other suggestion is to make sure your Sr. Management understands...This system will not reduce your workload. It will greatly increase and you will need resources (read as people) to assist with reviewing alerts, documenting investigation results and filing SARs.

Good Luck!

Thank you for your recommendations.

Automation DOES increase your work load. Reviewing daily reports can't compare with researching and commenting on the numbers of alerts generated by the new software, even if it is fine tuned. Management will think this big software expense will make your job easier, and it doesn't. Be prepared. Have your game plan AND your succession plan in place. Automated software adds an entirely new aspect to your succession plan. It will help a lot if you know and understand your core's setup. A little IT experience can't hurt either.

This times 1,000! Also be sure that both management and the vendor / consultant clearly understand exactly what is expected and is being paid for.

Validation is way too expensive.