Procedures for signing up for online banking

Posted By: ekbanker

Procedures for signing up for online banking - 09/15/06 03:44 PM

Currently, we allow our customers to sign up for online banking through our site. Then, our reps review the request online, approve them and mail their password and ID separately via US Postal service. Is there anything as far as compliance goes that we have to have our customers physically sign before they sign up. They have to agree to the online disclosure before requesting an ID & password, but that's all we have them do right now? Are we missing anything here? Thanks in advance for any responses!!
Posted By: Dazed and Confused

Re: Procedures for signing up for online banking - 09/15/06 04:17 PM

I do not believe any compliance issues exist with regard to your scenario. The decision to accept a customer's electronic signature vs. physical signature for on-line banking enrollment is up to the risk tolerance level of your bank. It sounds like your bank enrolls existing customers for on-line banking ... so you already went through the CIP steps.
Posted By: Spenser

Re: Procedures for signing up for online banking - 09/15/06 04:29 PM

Do you allow new customers (no previous relationship) to open accounts online? How do they make their first deposit?
Posted By: ekbanker

Re: Procedures for signing up for online banking - 09/15/06 06:04 PM

Thanks for the response! We only allow existing customers to sign up, so I think that does get us past the CIP requirements as we're satisfying them when they come in to open the account. Thanks again!
Posted By: Titanic

Re: Procedures for signing up for online banking - 09/27/06 06:36 PM

Quote:

Currently, we allow our customers to sign up for online banking through our site. Then, our reps review the request online, approve them and mail their password and ID separately via US Postal service.



How are you able to prove that a customer accepted the online agreements?

Do you have reports or certificates via the online banking system?

Do you mail usernames and password to address on file?

Do you perform any sort of callback procedures to ensure that the actual customer received the username and password?

Your Online banking risk assessment needs to detail all the risks involved in offering such enrollment process and what controls you have in place to mitigate those risks..
Posted By: 8675309

Re: Procedures for signing up for online banking - 09/29/06 01:01 AM

EK - Our procedures are similar except the User ID and password are mailed together. The most important step--and maybe you are doing this--is to make sure the information is sent to the address of record on your core system. If someone enrolls online and provides an address that is different than where their statements are mailed, that is a red flag.
Posted By: rlcarey

Re: Procedures for signing up for online banking - 09/29/06 02:07 AM

Whoa - you're kidding right??? ID and password in the same communication. I would suggest you re-evaluate that process. One mailbox theft and you are in deep doo-doo.
Posted By: A_G

Re: Procedures for signing up for online banking - 09/29/06 12:56 PM

Quote:

Whoa - you're kidding right??? ID and password in the same communication. I would suggest you re-evaluate that process. One mailbox theft and you are in deep doo-doo.



Agreed. During my last internal audit of internet banking I realized that usernames and passwords were being mailed together in the same envelope. High priority finding that needed to be fixed ASAP. Now one employee mails the username and another employee mails the passwords with a lag time of a few days.
Posted By: ekbanker

Re: Procedures for signing up for online banking - 10/04/06 02:37 PM

Quote:

How are you able to prove that a customer accepted the online agreements?

Do you have reports or certificates via the online banking system?

Do you mail usernames and password to address on file?

Do you perform any sort of callback procedures to ensure that the actual customer received the username and password?

Your Online banking risk assessment needs to detail all the risks involved in offering such enrollment process and what controls you have in place to mitigate those risks..



Our system will not allow a user to continue with the online enrollment process unless they accept the online agreement. If they decline the agreement, the enrollment process is cancelled. We do mail our IDs and passwords to the address on file. Their enrollment information must also match what we have on file. If it does not, we do call. Other than that, we do not call the customer.
Posted By: Harvey

Re: Procedures for signing up for online banking - 12/19/06 11:52 PM

I would like to open this issue again. My bank is considering allowing existing customers to sign up for online banking using a quick enroll system. The customer would enter their social security number, account number, first name, last name, city, zip, DATE of BIRTH, and mother's maiden name. As long as the information the customer entered matches the information we have on record, our system would automatically allow the customer access to their account. Our system will allow the customer to enter the userID and password that they want, plus has a check box that says they agree to the terms and conditions of our online banking. I am concerned about customer verification for regulatory and safety and soundness. Does anyone else have a problem with this.
Posted By: Dolly Nugent

Re: Procedures for signing up for online banking - 12/21/06 12:59 PM

We require customers to sign up for online banking in a branch office. It seems to me that the information you request can be easily obtained. Is that your concern?
Posted By: FraudHorn

Re: Procedures for signing up for online banking - 12/21/06 02:22 PM

Having cusomers come into a branch is probably less risky than online enrollment. However, a fraudster could probably find a way to pull that off too if they were ambitious enough. Online enrollment is a convenience to customers. As long as the bank has included the process in a risk assessment, included sufficient controls to mitigate the risk, I doubt your regulators will have a problem with the online enrollments described in this thread. Except the part about mailing user IDs and passwords together, that's a no no.