EXAMINATION PROCEDURES

**EXAMINATION OBJECTIVE:** Examiners should use the Retail Payment
Systems Examination Procedures to determine the adequacy of the
financial institution's and third-party service provider's policies,
business processes, personnel, and internal control systems used to
mitigate the risks of retail payment systems. Retail payment system
services include checks and share draft item processing, bankcards,
payment cards, automated clearinghouse (ACH), EFT/POS networks, and
electronic bill payment and person-to-person payment systems. An
examiner should base the scope of the examination on his or her
assessment of the risks and risk management practices relating to the
financial institution's retail payment system services. This assessment
should consider the formal policies and procedures established to
provide these services, as well as the effectiveness of the financial
institution's underlying internal control environment, including
information security, business continuity, disaster recovery, and vendor
management programs.

Financial institutions are exposed to numerous risks in providing retail
payment system services to customers. Depending on the complexity of
retail payment system activity, the examination coverage may require an
integrated team approach that includes the knowledge and skills of
safety and soundness examiners, IT examiners, and credit and compliance
specialists.

The examination procedures may be part of either an IT or safety and
soundness examination. Examiners can use the examination procedures in
their entirety or in a modular fashion to focus on particular retail
payment system products or business lines. Depending on the size and
complexity of the financial institution or service provider, not all of
the procedures are necessary to arrive at a conclusion regarding the
quality of risk management practices and performance.

-   Tier I objectives and procedures evaluate the effectiveness of the
    financial institution and service provider's retail payment systems
    internal controls and risk management processes that may be relied
    upon for the purpose of identifying and managing risks.

-   Tier II objectives and procedures provide additional validation as
    warranted by the risks to verify the effectiveness of the financial
    institution's and service provider's retail payment systems
    function.

TIER I OBJECTIVES AND PROCEDURES

+---------------------------+-----+-----------------------------------+
|                           | **W | **Comment**                       |
|                           | ork |                                   |
|                           | Pa  |                                   |
|                           | per |                                   |
|                           | Re  |                                   |
|                           | fer |                                   |
|                           | enc |                                   |
|                           | e** |                                   |
+===========================+=====+===================================+
| Objective 1: Determine    |     |                                   |
| the scope and objectives  |     |                                   |
| of the examination of the |     |                                   |
| retail payment systems    |     |                                   |
| function.                 |     |                                   |
+---------------------------+-----+-----------------------------------+
| 1.  Review past reports   |     |                                   |
|     for comments relating |     |                                   |
|     to retail payment     |     |                                   |
|     systems. Consider:    |     |                                   |
|                           |     |                                   |
| -   Regulatory reports of |     |                                   |
|     examination,          |     |                                   |
|     including consumer    |     |                                   |
|     and compliance        |     |                                   |
|     information.          |     |                                   |
|                           |     |                                   |
| -   Internal control      |     |                                   |
|     self-assessment       |     |                                   |
|     completed by business |     |                                   |
|     lines.                |     |                                   |
|                           |     |                                   |
| -   Internal and external |     |                                   |
|     audit reports         |     |                                   |
|     including annual      |     |                                   |
|     attestation letters.  |     |                                   |
|                           |     |                                   |
| -   Regulatory, audit,    |     |                                   |
|     and information       |     |                                   |
|     security reports from |     |                                   |
|     service providers.    |     |                                   |
|                           |     |                                   |
| -   Trade group, bankcard |     |                                   |
|     association,          |     |                                   |
|     interchange, and      |     |                                   |
|     clearinghouse         |     |                                   |
|     documentation         |     |                                   |
|     relating to services  |     |                                   |
|     provided by the       |     |                                   |
|     financial             |     |                                   |
|     institution,          |     |                                   |
|     particularly the      |     |                                   |
|     NACHA required annual |     |                                   |
|     security audit and    |     |                                   |
|     bankcard association  |     |                                   |
|     self assessments.     |     |                                   |
|                           |     |                                   |
| -   Supervisory strategy  |     |                                   |
|     documents, including  |     |                                   |
|     risk assessments.     |     |                                   |
|                           |     |                                   |
| -   Prior examination     |     |                                   |
|     work papers.          |     |                                   |
+---------------------------+-----+-----------------------------------+
| 2.  Review past reports   |     |                                   |
|     for comments relating |     |                                   |
|     to the institution's  |     |                                   |
|     internal control      |     |                                   |
|     environment and       |     |                                   |
|     technical             |     |                                   |
|     infrastructure.       |     |                                   |
|     Consider:             |     |                                   |
|                           |     |                                   |
| -   Internal controls,    |     |                                   |
|     including physical    |     |                                   |
|     and logical access    |     |                                   |
|     controls in the data  |     |                                   |
|     entry area, data      |     |                                   |
|     center, and item      |     |                                   |
|     processing            |     |                                   |
|     operations.           |     |                                   |
|                           |     |                                   |
| -   EFT/POS network       |     |                                   |
|     controls.             |     |                                   |
|                           |     |                                   |
| -   Inventory of computer |     |                                   |
|     hardware, software,   |     |                                   |
|     and                   |     |                                   |
|     telecommunications    |     |                                   |
|     protocols used to     |     |                                   |
|     support check item    |     |                                   |
|     processing, EFT/POS   |     |                                   |
|     transaction           |     |                                   |
|     processing, ACH, and  |     |                                   |
|     bankcard issuance and |     |                                   |
|     acquiring transaction |     |                                   |
|     services.             |     |                                   |
+---------------------------+-----+-----------------------------------+
| 3.  Identify and obtain   |     |                                   |
|     during discussions    |     |                                   |
|     with financial        |     |                                   |
|     institution or        |     |                                   |
|     service provider      |     |                                   |
|     management:           |     |                                   |
|                           |     |                                   |
| -   A description of the  |     |                                   |
|     retail payment system |     |                                   |
|     activity performed,   |     |                                   |
|     including transaction |     |                                   |
|     volumes, dollar       |     |                                   |
|     amounts, and scope of |     |                                   |
|     operations, including |     |                                   |
|     check item            |     |                                   |
|     processing, ACH,      |     |                                   |
|     bankcard issuing and  |     |                                   |
|     acquiring, clearance, |     |                                   |
|     settlement, and       |     |                                   |
|     EFT/POS network       |     |                                   |
|     activity.             |     |                                   |
|                           |     |                                   |
| -   The retail payment    |     |                                   |
|     system functions      |     |                                   |
|     performed through     |     |                                   |
|     outsourcing           |     |                                   |
|     relationships and the |     |                                   |
|     financial             |     |                                   |
|     institution's level   |     |                                   |
|     of reliance on those  |     |                                   |
|     services.             |     |                                   |
|                           |     |                                   |
| -   Any significant       |     |                                   |
|     changes in retail     |     |                                   |
|     payment system        |     |                                   |
|     policies, personnel,  |     |                                   |
|     products, and         |     |                                   |
|     services since the    |     |                                   |
|     last examination,     |     |                                   |
|     particularly the      |     |                                   |
|     introduction of new   |     |                                   |
|     retail payment        |     |                                   |
|     systems incorporating |     |                                   |
|     electronic bill       |     |                                   |
|     presentment and       |     |                                   |
|     payment (EBPP),       |     |                                   |
|     stored-value cards,   |     |                                   |
|     or P2P payment        |     |                                   |
|     systems.              |     |                                   |
|                           |     |                                   |
| -   A listing of all      |     |                                   |
|     clearinghouse         |     |                                   |
|     settlement            |     |                                   |
|     arrangements in which |     |                                   |
|     the financial         |     |                                   |
|     institution           |     |                                   |
|     participates.         |     |                                   |
|     Evaluate the          |     |                                   |
|     methodology used by   |     |                                   |
|     the financial         |     |                                   |
|     institution in        |     |                                   |
|     assessing its         |     |                                   |
|     settlement risk from  |     |                                   |
|     these arrangements.   |     |                                   |
|                           |     |                                   |
| -   Documentation of any  |     |                                   |
|     related operational   |     |                                   |
|     or credit losses      |     |                                   |
|     incurred, reasons for |     |                                   |
|     the losses, and       |     |                                   |
|     actions taken by      |     |                                   |
|     management to prevent |     |                                   |
|     future losses for     |     |                                   |
|     each retail payment   |     |                                   |
|     system.               |     |                                   |
+---------------------------+-----+-----------------------------------+
| 4.  Review the financial  |     |                                   |
|     institution's         |     |                                   |
|     response to any       |     |                                   |
|     retail payment        |     |                                   |
|     systems issues raised |     |                                   |
|     at the last           |     |                                   |
|     examination.          |     |                                   |
|     Consider:             |     |                                   |
|                           |     |                                   |
| -   Adequacy and timing   |     |                                   |
|     of corrective action. |     |                                   |
|                           |     |                                   |
| -   Resolution of root    |     |                                   |
|     causes rather than    |     |                                   |
|     specific issues.      |     |                                   |
|                           |     |                                   |
| -   Existence of          |     |                                   |
|     outstanding issues.   |     |                                   |
+---------------------------+-----+-----------------------------------+
| Objective 2: Determine    |     |                                   |
| the quality of oversight  |     |                                   |
| and support provided by   |     |                                   |
| the board of directors    |     |                                   |
| and management.           |     |                                   |
+---------------------------+-----+-----------------------------------+
| 1.  Determine the quality |     |                                   |
|     and effectiveness of  |     |                                   |
|     the financial         |     |                                   |
|     institution's retail  |     |                                   |
|     payment systems       |     |                                   |
|     management function.  |     |                                   |
|     Consider:             |     |                                   |
|                           |     |                                   |
| -   Data center and       |     |                                   |
|     network management    |     |                                   |
|     and the quality of    |     |                                   |
|     internal controls     |     |                                   |
|     over internal ATM     |     |                                   |
|     networks and gateway  |     |                                   |
|     connectivity to       |     |                                   |
|     regional and national |     |                                   |
|     EFT/POS and bankcard  |     |                                   |
|     networks.             |     |                                   |
|                           |     |                                   |
| -   Departmental          |     |                                   |
|     management and the    |     |                                   |
|     quality of internal   |     |                                   |
|     controls, including   |     |                                   |
|     separation of duties  |     |                                   |
|     and dual control      |     |                                   |
|     procedures, for       |     |                                   |
|     bankcard, ATM and     |     |                                   |
|     debit card, ACH,      |     |                                   |
|     check items, and      |     |                                   |
|     electronic banking    |     |                                   |
|     payment transaction   |     |                                   |
|     processing,           |     |                                   |
|     clearance, and        |     |                                   |
|     settlement activity.  |     |                                   |
|                           |     |                                   |
| -   Departmental          |     |                                   |
|     management and the    |     |                                   |
|     quality of GLBA       |     |                                   |
|     501(b) compliance     |     |                                   |
|     policies relating to  |     |                                   |
|     retail payment system |     |                                   |
|     generated customer    |     |                                   |
|     data.                 |     |                                   |
+---------------------------+-----+-----------------------------------+
| 2.  Assess management's   |     |                                   |
|     ability to manage     |     |                                   |
|     outsourcing           |     |                                   |
|     relationships with    |     |                                   |
|     retail payment system |     |                                   |
|     service providers and |     |                                   |
|     software vendors in   |     |                                   |
|     order to evaluate the |     |                                   |
|     adequacy of terms and |     |                                   |
|     conditions, and       |     |                                   |
|     ensure each party\'s  |     |                                   |
|     liabilities and       |     |                                   |
|     responsibilities are  |     |                                   |
|     clearly defined.      |     |                                   |
|     Consider:             |     |                                   |
|                           |     |                                   |
| -   Adequacy of contract  |     |                                   |
|     provisions including  |     |                                   |
|     service level,        |     |                                   |
|     performance           |     |                                   |
|     agreements,           |     |                                   |
|     responsibilities,     |     |                                   |
|     liabilities, and      |     |                                   |
|     management            |     |                                   |
|     monitoring.           |     |                                   |
|                           |     |                                   |
| -   Management's          |     |                                   |
|     determination of the  |     |                                   |
|     service provider's    |     |                                   |
|     compliance with       |     |                                   |
|     applicable financial  |     |                                   |
|     institution and       |     |                                   |
|     consumer regulations  |     |                                   |
|     and with third-party  |     |                                   |
|     requirements (e.g.,   |     |                                   |
|     NACHA, GLBA, bankcard |     |                                   |
|     association, and      |     |                                   |
|     interchange).         |     |                                   |
|                           |     |                                   |
| -   Adequacy of contract  |     |                                   |
|     provisions for        |     |                                   |
|     personnel, equipment, |     |                                   |
|     and related services. |     |                                   |
|                           |     |                                   |
| -   Adequacy of           |     |                                   |
|     provisions to obtain  |     |                                   |
|     management            |     |                                   |
|     information systems   |     |                                   |
|     (MIS) needed to       |     |                                   |
|     monitor the           |     |                                   |
|     third-party's         |     |                                   |
|     performance           |     |                                   |
|     appropriately.        |     |                                   |
+---------------------------+-----+-----------------------------------+
| 3.  Evaluate the adequacy |     |                                   |
|     and effectiveness of  |     |                                   |
|     financial institution |     |                                   |
|     and service provider  |     |                                   |
|     contingency and       |     |                                   |
|     business continuity   |     |                                   |
|     planning. Consider:   |     |                                   |
|                           |     |                                   |
| -   Ability to recover    |     |                                   |
|     transaction data and  |     |                                   |
|     supporting books and  |     |                                   |
|     records based on      |     |                                   |
|     retail payment system |     |                                   |
|     business line         |     |                                   |
|     requirements and time |     |                                   |
|     lines.                |     |                                   |
|                           |     |                                   |
| -   Level of testing      |     |                                   |
|     conducted to ensure   |     |                                   |
|     adequate preparation. |     |                                   |
|                           |     |                                   |
| -   Stand-in arrangements |     |                                   |
|     established with      |     |                                   |
|     other financial       |     |                                   |
|     institutions in the   |     |                                   |
|     event of an ATM       |     |                                   |
|     outage.               |     |                                   |
|                           |     |                                   |
| -   Alternative access    |     |                                   |
|     mechanisms in the     |     |                                   |
|     event of an outage to |     |                                   |
|     main access to        |     |                                   |
|     bankcard, ACH, and    |     |                                   |
|     other retail options. |     |                                   |
+---------------------------+-----+-----------------------------------+
| 4.  Evaluate retail       |     |                                   |
|     payment system        |     |                                   |
|     business line staff.  |     |                                   |
|     Consider:             |     |                                   |
|                           |     |                                   |
| -   Adequacy and quality  |     |                                   |
|     of staff resources.   |     |                                   |
|                           |     |                                   |
| -   Effectiveness of      |     |                                   |
|     policies and          |     |                                   |
|     procedures outlining  |     |                                   |
|     department duties,    |     |                                   |
|     including job         |     |                                   |
|     descriptions.         |     |                                   |
+---------------------------+-----+-----------------------------------+
| Objective 3: Determine    |     |                                   |
| the quality of risk       |     |                                   |
| management and support    |     |                                   |
| for bankcard issuance and |     |                                   |
| acquiring (merchant       |     |                                   |
| processing) activity.     |     |                                   |
+---------------------------+-----+-----------------------------------+
| 1.  Evaluate financial    |     |                                   |
|     institution adherence |     |                                   |
|     to bankcard           |     |                                   |
|     association rules and |     |                                   |
|     bylaws and regulatory |     |                                   |
|     guidance.             |     |                                   |
+---------------------------+-----+-----------------------------------+
| 2.  Evaluate whether card |     |                                   |
|     issuance processing   |     |                                   |
|     is outsourced to a    |     |                                   |
|     third party. If yes,  |     |                                   |
|     evaluate the vendor   |     |                                   |
|     management controls   |     |                                   |
|     in place to govern    |     |                                   |
|     the activities listed |     |                                   |
|     in steps 3 and 4.     |     |                                   |
+---------------------------+-----+-----------------------------------+
| 3.  Review internal       |     |                                   |
|     procedures employed   |     |                                   |
|     for each bankcard     |     |                                   |
|     product and assess:   |     |                                   |
|                           |     |                                   |
| -   The integrity of      |     |                                   |
|     plastic card and PIN  |     |                                   |
|     issuance processing.  |     |                                   |
|                           |     |                                   |
| -   Whether processing    |     |                                   |
|     includes appropriate  |     |                                   |
|     separation of         |     |                                   |
|     functions in card     |     |                                   |
|     issuance, PIN         |     |                                   |
|     issuance, control and |     |                                   |
|     storage of card       |     |                                   |
|     stock, and the        |     |                                   |
|     maintenance of        |     |                                   |
|     software controlling  |     |                                   |
|     PIN generation.       |     |                                   |
|                           |     |                                   |
| -   Whether the           |     |                                   |
|     institution has       |     |                                   |
|     established           |     |                                   |
|     procedures focusing   |     |                                   |
|     on controls           |     |                                   |
|     preventing card fraud |     |                                   |
|     and abuse.            |     |                                   |
+---------------------------+-----+-----------------------------------+
| 4.  Determine whether the |     |                                   |
|     audit function        |     |                                   |
|     periodically performs |     |                                   |
|     an inventory of all   |     |                                   |
|     bankcards at each     |     |                                   |
|     location owned or     |     |                                   |
|     operated by the       |     |                                   |
|     institution and that  |     |                                   |
|     each location is      |     |                                   |
|     included in the audit |     |                                   |
|     program, either       |     |                                   |
|     directly or           |     |                                   |
|     indirectly (e.g., as  |     |                                   |
|     part of a branch      |     |                                   |
|     audit).               |     |                                   |
+---------------------------+-----+-----------------------------------+
| 5.  Review a sample of    |     |                                   |
|     consumer contracts    |     |                                   |
|     for each bankcard     |     |                                   |
|     service to ensure     |     |                                   |
|     they adequately       |     |                                   |
|     describe the          |     |                                   |
|     responsibilities and  |     |                                   |
|     liabilities of the    |     |                                   |
|     institution and its   |     |                                   |
|     customers (compliance |     |                                   |
|     with Regulation Z).   |     |                                   |
+---------------------------+-----+-----------------------------------+
| 6.  Evaluate the          |     |                                   |
|     effectiveness of      |     |                                   |
|     internal clearance    |     |                                   |
|     and settlement        |     |                                   |
|     activity as it        |     |                                   |
|     relates to customer   |     |                                   |
|     bankcard              |     |                                   |
|     transactions.         |     |                                   |
|     Consider the adequacy |     |                                   |
|     of:                   |     |                                   |
|                           |     |                                   |
| -   Financial and         |     |                                   |
|     accounting controls   |     |                                   |
|     in place to clear and |     |                                   |
|     settle transactions.  |     |                                   |
|                           |     |                                   |
| -   Periodic              |     |                                   |
|     reconciliation of all |     |                                   |
|     account postings.     |     |                                   |
|                           |     |                                   |
| -   Timely clearance or   |     |                                   |
|     charge-off of missing |     |                                   |
|     items or              |     |                                   |
|     out-of-balance        |     |                                   |
|     situations.           |     |                                   |
+---------------------------+-----+-----------------------------------+
| 7.  Evaluate the          |     |                                   |
|     effectiveness of      |     |                                   |
|     internal credit       |     |                                   |
|     monitoring and card   |     |                                   |
|     authorization         |     |                                   |
|     performed by the      |     |                                   |
|     financial             |     |                                   |
|     institution. Consider |     |                                   |
|     the adequacy of:      |     |                                   |
|                           |     |                                   |
| -   Policies and          |     |                                   |
|     procedures for        |     |                                   |
|     underwriting, account |     |                                   |
|     management, and       |     |                                   |
|     collection            |     |                                   |
|     activities.           |     |                                   |
|                           |     |                                   |
| -   Card authorization    |     |                                   |
|     procedures to         |     |                                   |
|     mitigate fraudulent   |     |                                   |
|     use.                  |     |                                   |
|                           |     |                                   |
| -   MIS reports and       |     |                                   |
|     behavioral fraud      |     |                                   |
|     analysis.             |     |                                   |
+---------------------------+-----+-----------------------------------+
| 8.  For financial         |     |                                   |
|     institutions involved |     |                                   |
|     in bankcard acquiring |     |                                   |
|     (merchant processing) |     |                                   |
|     services, determine   |     |                                   |
|     the appropriateness   |     |                                   |
|     of controls over      |     |                                   |
|     merchant services.    |     |                                   |
|     Consider the adequacy |     |                                   |
|     of:                   |     |                                   |
|                           |     |                                   |
| -   New merchant approval |     |                                   |
|     and acceptance        |     |                                   |
|     process, termination  |     |                                   |
|     procedures, and       |     |                                   |
|     underwriting          |     |                                   |
|     guidelines for        |     |                                   |
|     merchant accounts.    |     |                                   |
|                           |     |                                   |
| -   Fraud and credit      |     |                                   |
|     monitoring procedures |     |                                   |
|     for all established   |     |                                   |
|     merchant accounts.    |     |                                   |
|                           |     |                                   |
| -   Chargeback processing |     |                                   |
|     procedures and        |     |                                   |
|     controls, including   |     |                                   |
|     the volume, age, and  |     |                                   |
|     losses associated     |     |                                   |
|     with merchant         |     |                                   |
|     chargebacks.          |     |                                   |
|                           |     |                                   |
| -   Agent bank programs   |     |                                   |
|     (for which the        |     |                                   |
|     financial institution |     |                                   |
|     performs merchant     |     |                                   |
|     processing for other  |     |                                   |
|     institutions), and    |     |                                   |
|     the level of          |     |                                   |
|     liability assumed by  |     |                                   |
|     the acquiring         |     |                                   |
|     financial             |     |                                   |
|     institution.          |     |                                   |
+---------------------------+-----+-----------------------------------+
| Objective 4: Determine    |     |                                   |
| the quality of risk       |     |                                   |
| management and support    |     |                                   |
| for EFT/POS processing    |     |                                   |
| activity.                 |     |                                   |
+---------------------------+-----+-----------------------------------+
| 1.  Evaluate financial    |     |                                   |
|     institution           |     |                                   |
|     compliance with       |     |                                   |
|     interchange rules and |     |                                   |
|     bylaws.               |     |                                   |
+---------------------------+-----+-----------------------------------+
| 2.  Review internal       |     |                                   |
|     procedures employed   |     |                                   |
|     for generating active |     |                                   |
|     ATM cards. Consider:  |     |                                   |
|                           |     |                                   |
| -   The integrity of PIN  |     |                                   |
|     issuance and          |     |                                   |
|     processing, including |     |                                   |
|     appropriate           |     |                                   |
|     separation of         |     |                                   |
|     functions between     |     |                                   |
|     card issuance, PIN    |     |                                   |
|     issuance, and card    |     |                                   |
|     stock control and     |     |                                   |
|     storage.              |     |                                   |
|                           |     |                                   |
| -   The maintenance of    |     |                                   |
|     software controlling  |     |                                   |
|     PIN generation. The   |     |                                   |
|     review should focus   |     |                                   |
|     on controls           |     |                                   |
|     preventing card fraud |     |                                   |
|     and abuse resulting   |     |                                   |
|     in financial loss to  |     |                                   |
|     the institution.      |     |                                   |
+---------------------------+-----+-----------------------------------+
| 3.  Determine whether the |     |                                   |
|     audit function        |     |                                   |
|     periodically performs |     |                                   |
|     an inventory of       |     |                                   |
|     unused ATM cardstock  |     |                                   |
|     at each location      |     |                                   |
|     owned or operated by  |     |                                   |
|     the institution and   |     |                                   |
|     that each location is |     |                                   |
|     included in the audit |     |                                   |
|     program, either       |     |                                   |
|     directly or           |     |                                   |
|     indirectly (e.g., as  |     |                                   |
|     part of a branch      |     |                                   |
|     audit).               |     |                                   |
+---------------------------+-----+-----------------------------------+
| 4.  Review a sample of    |     |                                   |
|     consumer contracts    |     |                                   |
|     for ATM service to    |     |                                   |
|     ensure they           |     |                                   |
|     adequately set forth  |     |                                   |
|     responsibilities and  |     |                                   |
|     liabilities of the    |     |                                   |
|     institution and the   |     |                                   |
|     custom­er. Evaluate    |     |                                   |
|     compliance with       |     |                                   |
|     applicable            |     |                                   |
|     regulations.          |     |                                   |
+---------------------------+-----+-----------------------------------+
| 5.  Evaluate the          |     |                                   |
|     effectiveness of      |     |                                   |
|     internal clearance    |     |                                   |
|     and settlement        |     |                                   |
|     activity as it        |     |                                   |
|     relates to customer   |     |                                   |
|     ATM transactions.     |     |                                   |
|     Consider whether:     |     |                                   |
|                           |     |                                   |
| -   Appropriate financial |     |                                   |
|     and accounting        |     |                                   |
|     controls are in place |     |                                   |
|     to clear and settle   |     |                                   |
|     ATM transactions.     |     |                                   |
|                           |     |                                   |
| -   Reconciliation is     |     |                                   |
|     performed             |     |                                   |
|     periodically for all  |     |                                   |
|     account postings.     |     |                                   |
+---------------------------+-----+-----------------------------------+
| Objective 5: Determine    |     |                                   |
| the quality of risk       |     |                                   |
| management and support    |     |                                   |
| for ACH processing        |     |                                   |
| activity.                 |     |                                   |
+---------------------------+-----+-----------------------------------+
| 1.  Evaluate financial    |     |                                   |
|     institution adherence |     |                                   |
|     to NACHA and          |     |                                   |
|     clearinghouse         |     |                                   |
|     operating rules and   |     |                                   |
|     regulations.          |     |                                   |
+---------------------------+-----+-----------------------------------+
| 2.  Review policies and   |     |                                   |
|     procedures in place   |     |                                   |
|     to monitor            |     |                                   |
|     originating customer  |     |                                   |
|     balances for credit   |     |                                   |
|     payments (e.g.,       |     |                                   |
|     payroll) to ensure    |     |                                   |
|     payments are made     |     |                                   |
|     against collected     |     |                                   |
|     funds or established  |     |                                   |
|     credit limits. Also   |     |                                   |
|     determine that        |     |                                   |
|     payments in excess of |     |                                   |
|     established credit    |     |                                   |
|     limits are properly   |     |                                   |
|     authorized.           |     |                                   |
+---------------------------+-----+-----------------------------------+
| 3.  Determine if the      |     |                                   |
|     institution treats    |     |                                   |
|     deposits resulting    |     |                                   |
|     from ACH transmitted  |     |                                   |
|     debits on other       |     |                                   |
|     accounts as           |     |                                   |
|     uncollected funds     |     |                                   |
|     until there is        |     |                                   |
|     reasonable assurance  |     |                                   |
|     the debits have been  |     |                                   |
|     paid by the           |     |                                   |
|     institution on which  |     |                                   |
|     they were drawn.      |     |                                   |
|     Also, determine if    |     |                                   |
|     management monitors   |     |                                   |
|     drawings against      |     |                                   |
|     uncollected funds to  |     |                                   |
|     ensure they are       |     |                                   |
|     within established    |     |                                   |
|     guidelines.           |     |                                   |
+---------------------------+-----+-----------------------------------+
| 4.  Review a sample of    |     |                                   |
|     contracts authorizing |     |                                   |
|     the institution to    |     |                                   |
|     originate ACH items   |     |                                   |
|     for customers and     |     |                                   |
|     determine whether     |     |                                   |
|     they adequately set   |     |                                   |
|     forth the             |     |                                   |
|     responsibilities of   |     |                                   |
|     the institution and   |     |                                   |
|     customer. Consider:   |     |                                   |
|                           |     |                                   |
| -   Whether contracted    |     |                                   |
|     third-party service   |     |                                   |
|     providers,            |     |                                   |
|     originating customer  |     |                                   |
|     entries, are also     |     |                                   |
|     customers of the      |     |                                   |
|     financial             |     |                                   |
|     institution.          |     |                                   |
|                           |     |                                   |
| -   Whether the           |     |                                   |
|     agreements include    |     |                                   |
|     recognition of all    |     |                                   |
|     relevant NACHA        |     |                                   |
|     requirements.         |     |                                   |
|                           |     |                                   |
| -   Whether ACH           |     |                                   |
|     clearinghouses to     |     |                                   |
|     which the financial   |     |                                   |
|     institution is a      |     |                                   |
|     member, stipulate the |     |                                   |
|     funding arrangements  |     |                                   |
|     (outgoing), Expedited |     |                                   |
|     Funds Availability    |     |                                   |
|     Act (Regulation CC),  |     |                                   |
|     UCC4A (credit         |     |                                   |
|     transfer only), and   |     |                                   |
|     Electronic Funds      |     |                                   |
|     Transfers (Regulation |     |                                   |
|     E).                   |     |                                   |
+---------------------------+-----+-----------------------------------+
| 5.  Determine if ACH      |     |                                   |
|     activities are        |     |                                   |
|     considered in the     |     |                                   |
|     institution's overall |     |                                   |
|     business continuity   |     |                                   |
|     plans and insurance   |     |                                   |
|     program.              |     |                                   |
+---------------------------+-----+-----------------------------------+
| 6.  Determine if          |     |                                   |
|     management monitors   |     |                                   |
|     originating customers |     |                                   |
|     for unreasonable      |     |                                   |
|     numbers of            |     |                                   |
|     unauthorized ACH      |     |                                   |
|     debits. If high, this |     |                                   |
|     could expose the      |     |                                   |
|     institution to        |     |                                   |
|     greater loss.         |     |                                   |
+---------------------------+-----+-----------------------------------+
| Objective 6: Determine    |     |                                   |
| the quality of risk       |     |                                   |
| management and support    |     |                                   |
| for electronic banking    |     |                                   |
| related retail payment    |     |                                   |
| transaction processing.   |     |                                   |
+---------------------------+-----+-----------------------------------+
| 1.  Determine the extent  |     |                                   |
|     to which the          |     |                                   |
|     financial institution |     |                                   |
|     engages in retail     |     |                                   |
|     payment systems,      |     |                                   |
|     including bill        |     |                                   |
|     payment, stored-value |     |                                   |
|     cards, and P2P        |     |                                   |
|     payments. Consider:   |     |                                   |
|                           |     |                                   |
| -   Strategic plans       |     |                                   |
|     relating to the       |     |                                   |
|     introduction of new   |     |                                   |
|     retail payment system |     |                                   |
|     products and          |     |                                   |
|     services.             |     |                                   |
|                           |     |                                   |
| -   The development of    |     |                                   |
|     internal pilot        |     |                                   |
|     programs and          |     |                                   |
|     partnerships with     |     |                                   |
|     technology vendors    |     |                                   |
|     introducing new       |     |                                   |
|     retail payment        |     |                                   |
|     systems and delivery  |     |                                   |
|     channels.             |     |                                   |
|                           |     |                                   |
| -   The extent to which   |     |                                   |
|     existing Internet and |     |                                   |
|     e-banking products    |     |                                   |
|     and services include  |     |                                   |
|     new retail payment    |     |                                   |
|     mechanisms.           |     |                                   |
+---------------------------+-----+-----------------------------------+
| 2.  Evaluate the          |     |                                   |
|     financial             |     |                                   |
|     institution's ability |     |                                   |
|     to manage the         |     |                                   |
|     development and       |     |                                   |
|     implementation of new |     |                                   |
|     retail payment        |     |                                   |
|     services, focusing on |     |                                   |
|     internal controls     |     |                                   |
|     effectiveness and     |     |                                   |
|     consumer compliance   |     |                                   |
|     provisions. Consider: |     |                                   |
|                           |     |                                   |
| -   Information security, |     |                                   |
|     including             |     |                                   |
|     identification and    |     |                                   |
|     authentication        |     |                                   |
|     systems, in the       |     |                                   |
|     deployment of any     |     |                                   |
|     smart cards, EBPP,    |     |                                   |
|     and P2P product       |     |                                   |
|     offerings.            |     |                                   |
|                           |     |                                   |
| -   Customer disclosure   |     |                                   |
|     and compliance        |     |                                   |
|     information to retail |     |                                   |
|     payment systems using |     |                                   |
|     new technologies.     |     |                                   |
|                           |     |                                   |
| -   Technical resources   |     |                                   |
|     to effectively manage |     |                                   |
|     retail payment        |     |                                   |
|     systems including     |     |                                   |
|     Internet              |     |                                   |
|     technologies,         |     |                                   |
|     telecommunications    |     |                                   |
|     protocols, and        |     |                                   |
|     operations support.   |     |                                   |
+---------------------------+-----+-----------------------------------+
| 3.  Evaluate the          |     |                                   |
|     financial             |     |                                   |
|     institution's ability |     |                                   |
|     to incorporate new    |     |                                   |
|     retail payment        |     |                                   |
|     product offerings     |     |                                   |
|     into its existing     |     |                                   |
|     retail business lines |     |                                   |
|     and determine its     |     |                                   |
|     effectiveness in      |     |                                   |
|     including these       |     |                                   |
|     product offerings in  |     |                                   |
|     its traditional       |     |                                   |
|     retail payment        |     |                                   |
|     operations. Consider: |     |                                   |
|                           |     |                                   |
| -   The integration of    |     |                                   |
|     new retail payment    |     |                                   |
|     product offerings     |     |                                   |
|     with existing         |     |                                   |
|     clearance,            |     |                                   |
|     settlement, and       |     |                                   |
|     accounting functions. |     |                                   |
|                           |     |                                   |
| -   Whether the financial |     |                                   |
|     institution relies on |     |                                   |
|     third-party providers |     |                                   |
|     for some or all of    |     |                                   |
|     these services.       |     |                                   |
+---------------------------+-----+-----------------------------------+
| Objective 7: Determine    |     |                                   |
| the quality of risk       |     |                                   |
| management and support    |     |                                   |
| for checks.               |     |                                   |
+---------------------------+-----+-----------------------------------+
| 1.  Determine if the      |     |                                   |
|     accounting department |     |                                   |
|     handles check return  |     |                                   |
|     item processing       |     |                                   |
|     appropriately and     |     |                                   |
|     reconciles all aged   |     |                                   |
|     items.                |     |                                   |
+---------------------------+-----+-----------------------------------+
| 2.  Determine whether the |     |                                   |
|     institution uses      |     |                                   |
|     electronic check      |     |                                   |
|     presentment (ECP) for |     |                                   |
|     payment. If yes,      |     |                                   |
|     consider:             |     |                                   |
|                           |     |                                   |
| -   The effectiveness of  |     |                                   |
|     the financial         |     |                                   |
|     institution's ECP     |     |                                   |
|     implementation,       |     |                                   |
|     including logical     |     |                                   |
|     access controls over  |     |                                   |
|     electronic files      |     |                                   |
|     storing MICR and      |     |                                   |
|     related information.  |     |                                   |
|                           |     |                                   |
| -   Whether the financial |     |                                   |
|     institution is using  |     |                                   |
|     positive pay.         |     |                                   |
|     Determine whether the |     |                                   |
|     logical access        |     |                                   |
|     controls over the     |     |                                   |
|     electronic files sent |     |                                   |
|     by commercial         |     |                                   |
|     businesses are        |     |                                   |
|     adequately            |     |                                   |
|     controlled.           |     |                                   |
+---------------------------+-----+-----------------------------------+
| CONCLUSIONS               |     |                                   |
+---------------------------+-----+-----------------------------------+
| 1.  Determine the need to |     |                                   |
|     conduct Tier II       |     |                                   |
|     procedures for        |     |                                   |
|     additional validation |     |                                   |
|     to support            |     |                                   |
|     conclusions related   |     |                                   |
|     to any of the Tier I  |     |                                   |
|     objectives.           |     |                                   |
+---------------------------+-----+-----------------------------------+
| 2.  From the procedures   |     |                                   |
|     performed, including  |     |                                   |
|     any Tier II           |     |                                   |
|     procedures performed: |     |                                   |
|                           |     |                                   |
| -   Document conclusions  |     |                                   |
|     related to the        |     |                                   |
|     quality and           |     |                                   |
|     effectiveness of the  |     |                                   |
|     management of the     |     |                                   |
|     retail payment        |     |                                   |
|     systems function.     |     |                                   |
|                           |     |                                   |
| -   Determine and         |     |                                   |
|     document to what      |     |                                   |
|     extent, if any, the   |     |                                   |
|     examiner may rely     |     |                                   |
|     upon retail payment   |     |                                   |
|     systems procedures    |     |                                   |
|     performed by internal |     |                                   |
|     or external audit.    |     |                                   |
+---------------------------+-----+-----------------------------------+
| 3.  Review your           |     |                                   |
|     preliminary           |     |                                   |
|     conclusions with the  |     |                                   |
|     examiner-in-charge    |     |                                   |
|     (EIC) regarding:      |     |                                   |
|                           |     |                                   |
| -   Violations of law,    |     |                                   |
|     rulings, regulations, |     |                                   |
|     and third-party       |     |                                   |
|     agreements.           |     |                                   |
|                           |     |                                   |
| -   Significant issues    |     |                                   |
|     warranting inclusion  |     |                                   |
|     as matters requiring  |     |                                   |
|     board attention or    |     |                                   |
|     recommendations in    |     |                                   |
|     the report of         |     |                                   |
|     examination.          |     |                                   |
|                           |     |                                   |
| -   Potential impact of   |     |                                   |
|     your conclusions on   |     |                                   |
|     the Uniform Rating    |     |                                   |
|     System for            |     |                                   |
|     Information           |     |                                   |
|     Technology (URSIT)    |     |                                   |
|     composite and         |     |                                   |
|     component ratings.    |     |                                   |
+---------------------------+-----+-----------------------------------+
| 4.  Discuss your findings |     |                                   |
|     with management and   |     |                                   |
|     obtain proposed       |     |                                   |
|     corrective action for |     |                                   |
|     significant           |     |                                   |
|     deficiencies.         |     |                                   |
+---------------------------+-----+-----------------------------------+
| 5.  Document your         |     |                                   |
|     conclusions in a memo |     |                                   |
|     to the EIC that       |     |                                   |
|     provides report-ready |     |                                   |
|     comments for all      |     |                                   |
|     relevant sections of  |     |                                   |
|     the FFIEC report of   |     |                                   |
|     examination (ROE) and |     |                                   |
|     guidance to future    |     |                                   |
|     examiners.            |     |                                   |
+---------------------------+-----+-----------------------------------+
| 6.  Organize work papers  |     |                                   |
|     to ensure clear       |     |                                   |
|     support for           |     |                                   |
|     significant findings  |     |                                   |
|     and conclusions.      |     |                                   |
+---------------------------+-----+-----------------------------------+

**TIER II OBJECTIVE AND PROCEDURES**

Examination Objective: The Tier II Retail Payment Systems Examination
Procedures provide additional validation procedures verifying the
effectiveness of a financial institution's internal control processes
over ACH processing, EFT/POS network processing, check item processing,
electronic banking-related retail payments processing, and bankcard
processing, clearance, and settlement. These procedures assist in
achieving examination objectives, and examiners may use them in their
entirety or selectively. Examiners should coordinate this coverage with
other examiners involved in assessing the institution's information
systems, operations, information security, and vendor management
effectiveness to ensure there is an adequate understanding of the
control environment as it pertains to retail payment business lines and
to avoid duplication of effort.

+---------------------------+-----+-----------------------------------+
|                           | **W | **Comment**                       |
|                           | ork |                                   |
|                           | Pa  |                                   |
|                           | per |                                   |
|                           | Re  |                                   |
|                           | fer |                                   |
|                           | enc |                                   |
|                           | e** |                                   |
+===========================+=====+===================================+
| Objective                 |     |                                   |
+---------------------------+-----+-----------------------------------+
| 1.  If the financial      |     |                                   |
|     institution is a      |     |                                   |
|     participant in a      |     |                                   |
|     shared EFT/POS        |     |                                   |
|     network or contracts  |     |                                   |
|     with a third-party    |     |                                   |
|     bankcard-issuing or   |     |                                   |
|     -acquiring processing |     |                                   |
|     service providers,    |     |                                   |
|     consider whether:     |     |                                   |
|                           |     |                                   |
| -   Contracts with        |     |                                   |
|     regional EFT/POS      |     |                                   |
|     network switch and    |     |                                   |
|     gateway operators and |     |                                   |
|     bankcard processors   |     |                                   |
|     clearly set forth the |     |                                   |
|     rights and            |     |                                   |
|     responsibilities of   |     |                                   |
|     all parties,          |     |                                   |
|     including the         |     |                                   |
|     integrity and         |     |                                   |
|     confidentiality of    |     |                                   |
|     customer information, |     |                                   |
|     ownership of data,    |     |                                   |
|     settlement terms,     |     |                                   |
|     contingency and       |     |                                   |
|     business recovery     |     |                                   |
|     plans, and            |     |                                   |
|     requirements for      |     |                                   |
|     installing and        |     |                                   |
|     servicing equipment   |     |                                   |
|     and software.         |     |                                   |
|                           |     |                                   |
| -   Adequate agreements   |     |                                   |
|     are in place with all |     |                                   |
|     vendors supplying     |     |                                   |
|     services for retail   |     |                                   |
|     EFT/POS and bankcard  |     |                                   |
|     operations (plastic   |     |                                   |
|     cards, ATM equipment  |     |                                   |
|     and software          |     |                                   |
|     maintenance, ATM cash |     |                                   |
|     replenishment) that   |     |                                   |
|     clearly define the    |     |                                   |
|     responsibilities of   |     |                                   |
|     both the vendor and   |     |                                   |
|     the institution.      |     |                                   |
|                           |     |                                   |
| -   Agreements include a  |     |                                   |
|     provision of minimum  |     |                                   |
|     acceptable control    |     |                                   |
|     standards, the        |     |                                   |
|     ability of the        |     |                                   |
|     institution to audit  |     |                                   |
|     the vendors           |     |                                   |
|     operations, periodic  |     |                                   |
|     submission of         |     |                                   |
|     financial statements  |     |                                   |
|     to the institution,   |     |                                   |
|     and contingency and   |     |                                   |
|     business recovery     |     |                                   |
|     plans.                |     |                                   |
|                           |     |                                   |
| -   Contracts and         |     |                                   |
|     agreements clearly    |     |                                   |
|     define                |     |                                   |
|     responsibilities and  |     |                                   |
|     limits of liability   |     |                                   |
|     for both the customer |     |                                   |
|     and financial         |     |                                   |
|     institution and       |     |                                   |
|     include provisions of |     |                                   |
|     the Electronic Funds  |     |                                   |
|     Transfer Act          |     |                                   |
|     (Regulation E) and    |     |                                   |
|     the Expedited Funds   |     |                                   |
|     Availability Act      |     |                                   |
|     (Regulation CC) for   |     |                                   |
|     deposit activities.   |     |                                   |
+---------------------------+-----+-----------------------------------+
| 2.  Determine whether     |     |                                   |
|     management            |     |                                   |
|     periodically reviews  |     |                                   |
|     individual sites      |     |                                   |
|     providing retail      |     |                                   |
|     EFT/POS and bankcard  |     |                                   |
|     services to ensure    |     |                                   |
|     policies, procedures, |     |                                   |
|     security measures,    |     |                                   |
|     and equipment         |     |                                   |
|     maintenance           |     |                                   |
|     requirements are      |     |                                   |
|     appropriate.          |     |                                   |
+---------------------------+-----+-----------------------------------+
| 3.  For retail EFT/POS    |     |                                   |
|     and bankcard          |     |                                   |
|     transaction           |     |                                   |
|     processing activities |     |                                   |
|     contracted to         |     |                                   |
|     third-party service   |     |                                   |
|     providers, assess the |     |                                   |
|     adequacy of the       |     |                                   |
|     review process        |     |                                   |
|     performed by          |     |                                   |
|     management regarding  |     |                                   |
|     annual financial      |     |                                   |
|     statements and audit  |     |                                   |
|     reports.              |     |                                   |
+---------------------------+-----+-----------------------------------+
| Objective 2: Personal     |     |                                   |
| Identification Numbers    |     |                                   |
| (PIN)                     |     |                                   |
+---------------------------+-----+-----------------------------------+
| 1.  Assess staff access   |     |                                   |
|     to PIN data. Ensure   |     |                                   |
|     there is separation   |     |                                   |
|     of duties between     |     |                                   |
|     staff responsible for |     |                                   |
|     card operations and   |     |                                   |
|     staff responsible for |     |                                   |
|     preparing or issuing  |     |                                   |
|     bankcards.            |     |                                   |
+---------------------------+-----+-----------------------------------+
| 2.  Assess the PIN        |     |                                   |
|     generation process.   |     |                                   |
|     Ensure there is       |     |                                   |
|     separation of duties  |     |                                   |
|     between staff         |     |                                   |
|     responsible for PIN   |     |                                   |
|     generation and staff  |     |                                   |
|     responsible for       |     |                                   |
|     opening accounts or   |     |                                   |
|     with access to        |     |                                   |
|     customer account      |     |                                   |
|     information.          |     |                                   |
+---------------------------+-----+-----------------------------------+
| 3.  For new PIN issuance, |     |                                   |
|     assess the adequacy   |     |                                   |
|     of control procedures |     |                                   |
|     including             |     |                                   |
|     accountability        |     |                                   |
|     assigned to staff     |     |                                   |
|     initiating such       |     |                                   |
|     transactions.         |     |                                   |
+---------------------------+-----+-----------------------------------+
| 4.  Assess PIN generation |     |                                   |
|     and issuance          |     |                                   |
|     procedures to         |     |                                   |
|     determine whether     |     |                                   |
|     they preclude         |     |                                   |
|     matching an assigned  |     |                                   |
|     PIN to a customer's   |     |                                   |
|     account number or     |     |                                   |
|     bankcard.             |     |                                   |
+---------------------------+-----+-----------------------------------+
| 5.  Assess the threshold  |     |                                   |
|     for PIN access        |     |                                   |
|     attempts to customer  |     |                                   |
|     account information   |     |                                   |
|     and funds. The        |     |                                   |
|     threshold parameter   |     |                                   |
|     should be set at a    |     |                                   |
|     reasonable number of  |     |                                   |
|     unsuccessful          |     |                                   |
|     attempts.             |     |                                   |
+---------------------------+-----+-----------------------------------+
| 6.  Assess the level of   |     |                                   |
|     PIN encryption when   |     |                                   |
|     stored on computer    |     |                                   |
|     files or transmitted  |     |                                   |
|     over                  |     |                                   |
|     telecommunication     |     |                                   |
|     lines.                |     |                                   |
+---------------------------+-----+-----------------------------------+
| 7.  If resets are         |     |                                   |
|     allowed, assess the   |     |                                   |
|     procedures and        |     |                                   |
|     controls for          |     |                                   |
|     PIN/password resets.  |     |                                   |
|     The use of single-use |     |                                   |
|     and temporary         |     |                                   |
|     PIN/password is       |     |                                   |
|     preferred.            |     |                                   |
+---------------------------+-----+-----------------------------------+
| 8.  Assess the adequacy   |     |                                   |
|     of procedures for     |     |                                   |
|     prohibiting PIN       |     |                                   |
|     information from      |     |                                   |
|     being disclosed over  |     |                                   |
|     the telephone.        |     |                                   |
+---------------------------+-----+-----------------------------------+
| 9.  Assess staff access   |     |                                   |
|     to PIN-related        |     |                                   |
|     databases and         |     |                                   |
|     determine if          |     |                                   |
|     management restricts  |     |                                   |
|     access to authorized  |     |                                   |
|     personnel. Assess     |     |                                   |
|     database maintenance  |     |                                   |
|     activities to ensure  |     |                                   |
|     management closely    |     |                                   |
|     supervises and logs   |     |                                   |
|     staff access.         |     |                                   |
+---------------------------+-----+-----------------------------------+
| 10. Assess customer PIN   |     |                                   |
|     selection criteria,   |     |                                   |
|     focusing on whether   |     |                                   |
|     the institution       |     |                                   |
|     discourages or        |     |                                   |
|     prevents customers    |     |                                   |
|     from using common     |     |                                   |
|     words, sequences of   |     |                                   |
|     numbers, or words or  |     |                                   |
|     numbers that can      |     |                                   |
|     easily identify the   |     |                                   |
|     customer.             |     |                                   |
+---------------------------+-----+-----------------------------------+
| Objective 3: Information  |     |                                   |
| Security                  |     |                                   |
+---------------------------+-----+-----------------------------------+
| 1.  Evaluate the logical  |     |                                   |
|     and physical security |     |                                   |
|     controls to ensure    |     |                                   |
|     the availability and  |     |                                   |
|     integrity of          |     |                                   |
|     production retail     |     |                                   |
|     payment systems       |     |                                   |
|     applications.         |     |                                   |
|     Consider:             |     |                                   |
|                           |     |                                   |
| -   Whether the physical  |     |                                   |
|     and logical security  |     |                                   |
|     controls established  |     |                                   |
|     for retail payment    |     |                                   |
|     transaction           |     |                                   |
|     processing,           |     |                                   |
|     clearance, and        |     |                                   |
|     settlement services   |     |                                   |
|     maintain transaction  |     |                                   |
|     confidentiality and   |     |                                   |
|     integrity.            |     |                                   |
|                           |     |                                   |
| -   Whether physical      |     |                                   |
|     controls limit access |     |                                   |
|     to only those staff   |     |                                   |
|     assigned              |     |                                   |
|     responsibility for    |     |                                   |
|     supporting the        |     |                                   |
|     operations and        |     |                                   |
|     business line centers |     |                                   |
|     processing retail     |     |                                   |
|     payment and           |     |                                   |
|     accounting            |     |                                   |
|     transactions.         |     |                                   |
|                           |     |                                   |
| -   Whether physical      |     |                                   |
|     controls provide for  |     |                                   |
|     the ability to        |     |                                   |
|     monitor and document  |     |                                   |
|     access to all retail  |     |                                   |
|     payment operations    |     |                                   |
|     facilities.           |     |                                   |
+---------------------------+-----+-----------------------------------+
| 2.  Evaluate the          |     |                                   |
|     effectiveness of all  |     |                                   |
|     logical access        |     |                                   |
|     controls assigned for |     |                                   |
|     staff responsible for |     |                                   |
|     retail                |     |                                   |
|     payment-related       |     |                                   |
|     services. Consider:   |     |                                   |
|                           |     |                                   |
| -   Whether management    |     |                                   |
|     bases controls on     |     |                                   |
|     separation-of-duties  |     |                                   |
|     principles routinely  |     |                                   |
|     implemented for the   |     |                                   |
|     processing of         |     |                                   |
|     financial             |     |                                   |
|     transactions.         |     |                                   |
|                           |     |                                   |
| -   Whether               |     |                                   |
|     identification and    |     |                                   |
|     authentication        |     |                                   |
|     schemes include       |     |                                   |
|     requiring unique      |     |                                   |
|     logon identifiers     |     |                                   |
|     with strong password  |     |                                   |
|     requirements.         |     |                                   |
|                           |     |                                   |
| -   Whether management    |     |                                   |
|     bases access controls |     |                                   |
|     on a need-to-know     |     |                                   |
|     basis.                |     |                                   |
|                           |     |                                   |
| -   Whether management    |     |                                   |
|     bases assigned access |     |                                   |
|     to retail payment     |     |                                   |
|     applications and data |     |                                   |
|     on functional staff   |     |                                   |
|     job duties and        |     |                                   |
|     requirements.         |     |                                   |
+---------------------------+-----+-----------------------------------+
| 3.  Evaluate the security |     |                                   |
|     procedures for        |     |                                   |
|     periodic password     |     |                                   |
|     changes, the          |     |                                   |
|     encryption of         |     |                                   |
|     password files,       |     |                                   |
|     password suppression  |     |                                   |
|     on terminals, and     |     |                                   |
|     automatic shutdown of |     |                                   |
|     terminals not in use. |     |                                   |
+---------------------------+-----+-----------------------------------+
| 4.  Assess whether the    |     |                                   |
|     institution encrypts  |     |                                   |
|     telecommunications    |     |                                   |
|     lines used to receive |     |                                   |
|     and transmit retail   |     |                                   |
|     customer and          |     |                                   |
|     financial institution |     |                                   |
|     counter-party data.   |     |                                   |
|     If not encrypted,     |     |                                   |
|     evaluate the          |     |                                   |
|     compensating controls |     |                                   |
|     to secure retail      |     |                                   |
|     payment data in       |     |                                   |
|     transit.              |     |                                   |
+---------------------------+-----+-----------------------------------+
| Objective 4: Card         |     |                                   |
| Issuance                  |     |                                   |
+---------------------------+-----+-----------------------------------+
| 1.  Assess bankcard       |     |                                   |
|     issuance activities,  |     |                                   |
|     and review control    |     |                                   |
|     procedures. Consider  |     |                                   |
|     if management:        |     |                                   |
|                           |     |                                   |
| -   Issues bankcards only |     |                                   |
|     as requested.         |     |                                   |
|                           |     |                                   |
| -   Periodically          |     |                                   |
|     inventories           |     |                                   |
|     bankcards.            |     |                                   |
|                           |     |                                   |
| -   Maintains adequate    |     |                                   |
|     controls for          |     |                                   |
|     activating new        |     |                                   |
|     accounts.             |     |                                   |
+---------------------------+-----+-----------------------------------+
| 2.  Assess effectiveness  |     |                                   |
|     of the dual control   |     |                                   |
|     procedures for blank  |     |                                   |
|     card stock in each of |     |                                   |
|     the encoding,         |     |                                   |
|     embossing, and        |     |                                   |
|     mailing steps.        |     |                                   |
+---------------------------+-----+-----------------------------------+
| 3.  Assess physical       |     |                                   |
|     access controls for   |     |                                   |
|     card encoding areas.  |     |                                   |
|     Management should     |     |                                   |
|     allow access to       |     |                                   |
|     authorized personnel  |     |                                   |
|     only.                 |     |                                   |
+---------------------------+-----+-----------------------------------+
| 4.  Assess whether        |     |                                   |
|     inventory controls    |     |                                   |
|     for plastic card      |     |                                   |
|     stock make them       |     |                                   |
|     physically secure.    |     |                                   |
+---------------------------+-----+-----------------------------------+
| 5.  Assess whether        |     |                                   |
|     management restricts  |     |                                   |
|     the use of bankcard   |     |                                   |
|     encoding equipment to |     |                                   |
|     authorized personnel  |     |                                   |
|     only.                 |     |                                   |
+---------------------------+-----+-----------------------------------+
| 6.  Assess procedures for |     |                                   |
|     issuing cards from    |     |                                   |
|     more than one         |     |                                   |
|     location (e.g.,       |     |                                   |
|     branches) to ensure   |     |                                   |
|     there are             |     |                                   |
|     accountability and    |     |                                   |
|     bankcard control      |     |                                   |
|     procedures at each    |     |                                   |
|     card-issuing          |     |                                   |
|     location.             |     |                                   |
+---------------------------+-----+-----------------------------------+
| 7.  Assess institution    |     |                                   |
|     card-mailing          |     |                                   |
|     procedures. Ensure    |     |                                   |
|     the institution mails |     |                                   |
|     the card and          |     |                                   |
|     associated PIN to     |     |                                   |
|     customers in separate |     |                                   |
|     envelopes. Also       |     |                                   |
|     ensure that the       |     |                                   |
|     return address does   |     |                                   |
|     not identify the      |     |                                   |
|     institution.          |     |                                   |
+---------------------------+-----+-----------------------------------+
| 8.  Assess whether        |     |                                   |
|     mailing procedures    |     |                                   |
|     provide for a         |     |                                   |
|     sufficient period of  |     |                                   |
|     time in between the   |     |                                   |
|     card and PIN mailing. |     |                                   |
+---------------------------+-----+-----------------------------------+
| 9.  Assess returned card  |     |                                   |
|     procedures. Determine |     |                                   |
|     whether adequate      |     |                                   |
|     controls are in place |     |                                   |
|     to ensure returned    |     |                                   |
|     cards are not sent to |     |                                   |
|     staff with access to, |     |                                   |
|     or responsibility     |     |                                   |
|     for, issuing cards.   |     |                                   |
+---------------------------+-----+-----------------------------------+
| 10. Assess whether there  |     |                                   |
|     is appropriate        |     |                                   |
|     follow-up to          |     |                                   |
|     determine whether the |     |                                   |
|     correct customer      |     |                                   |
|     received the card and |     |                                   |
|     PIN.                  |     |                                   |
+---------------------------+-----+-----------------------------------+
| 11. Assess the adequacy   |     |                                   |
|     of control procedures |     |                                   |
|     (e.g., hot card lists |     |                                   |
|     and expiration dates) |     |                                   |
|     to limit the period   |     |                                   |
|     of exposure if a card |     |                                   |
|     is lost, stolen, or   |     |                                   |
|     purposely misused.    |     |                                   |
+---------------------------+-----+-----------------------------------+
| 12. Establish whether the |     |                                   |
|     institution destroys  |     |                                   |
|     captured and spoiled  |     |                                   |
|     cards under dual      |     |                                   |
|     control and maintains |     |                                   |
|     records of all        |     |                                   |
|     destroyed cards.      |     |                                   |
+---------------------------+-----+-----------------------------------+
| 13. Assess whether the    |     |                                   |
|     institution           |     |                                   |
|     adequately controls   |     |                                   |
|     test or demonstration |     |                                   |
|     cards.                |     |                                   |
+---------------------------+-----+-----------------------------------+
| 14. Assess whether        |     |                                   |
|     management maintains  |     |                                   |
|     satisfactory controls |     |                                   |
|     over the issuance of  |     |                                   |
|     replacement or        |     |                                   |
|     additional cards to   |     |                                   |
|     the customer (e.g.,   |     |                                   |
|     temporary access      |     |                                   |
|     cards issued to the   |     |                                   |
|     customer).            |     |                                   |
+---------------------------+-----+-----------------------------------+
| 15. Assess the vendor     |     |                                   |
|     management program to |     |                                   |
|     determine whether the |     |                                   |
|     institution reviews   |     |                                   |
|     card issuance         |     |                                   |
|     services contracted   |     |                                   |
|     to third parties for  |     |                                   |
|     compliance with       |     |                                   |
|     appropriate bankcard  |     |                                   |
|     control procedures.   |     |                                   |
+---------------------------+-----+-----------------------------------+
| Objective 5: Business     |     |                                   |
| Continuity Planning       |     |                                   |
+---------------------------+-----+-----------------------------------+
| 1.  Assess the financial  |     |                                   |
|     institution's         |     |                                   |
|     business continuity   |     |                                   |
|     plans and review the  |     |                                   |
|     adequacy of these     |     |                                   |
|     plans for a partial   |     |                                   |
|     or complete failure   |     |                                   |
|     of each retail        |     |                                   |
|     payment system.       |     |                                   |
|     Determine if the      |     |                                   |
|     plans include:        |     |                                   |
|                           |     |                                   |
| -   Recovery of all       |     |                                   |
|     required components   |     |                                   |
|     linking the           |     |                                   |
|     institution with      |     |                                   |
|     third-party network   |     |                                   |
|     switch, gateway, or   |     |                                   |
|     related third-party   |     |                                   |
|     data centers and      |     |                                   |
|     bankcard processors.  |     |                                   |
|                           |     |                                   |
| -   Information relative  |     |                                   |
|     to the volume and     |     |                                   |
|     importance of the     |     |                                   |
|     retail payment system |     |                                   |
|     activity to the       |     |                                   |
|     institution's overall |     |                                   |
|     operation.            |     |                                   |
|                           |     |                                   |
| -   Provisions for        |     |                                   |
|     acceptable store and  |     |                                   |
|     forward procedures to |     |                                   |
|     protect against loss  |     |                                   |
|     or duplication of     |     |                                   |
|     data and to ensure    |     |                                   |
|     full recovery within  |     |                                   |
|     reasonable time       |     |                                   |
|     periods.              |     |                                   |
|                           |     |                                   |
| -   Stand-in arrangements |     |                                   |
|     with other financial  |     |                                   |
|     institutions included |     |                                   |
|     within the plan,      |     |                                   |
|     allowing for interim  |     |                                   |
|     bankcard processing   |     |                                   |
|     in the event of an    |     |                                   |
|     outage.               |     |                                   |
|                           |     |                                   |
| -   Adequate testing of   |     |                                   |
|     plans accounting for  |     |                                   |
|     various recovery      |     |                                   |
|     scenarios.            |     |                                   |
+---------------------------+-----+-----------------------------------+
| Objective 6: EFT/POS and  |     |                                   |
| Bankcard Accounting and   |     |                                   |
| Transaction Processing    |     |                                   |
+---------------------------+-----+-----------------------------------+
| 1.  Assess the adequacy   |     |                                   |
|     of reconciliation     |     |                                   |
|     processes for general |     |                                   |
|     ledger accounts       |     |                                   |
|     related to bankcard   |     |                                   |
|     and debit card        |     |                                   |
|     transaction           |     |                                   |
|     processing activity.  |     |                                   |
|     Consider whether:     |     |                                   |
|                           |     |                                   |
| -   Accounting reconciles |     |                                   |
|     bankcard and ATM      |     |                                   |
|     transaction           |     |                                   |
|     origination daily.    |     |                                   |
|                           |     |                                   |
| -   Retail payment system |     |                                   |
|     supervisory personnel |     |                                   |
|     periodically review   |     |                                   |
|     reconcilement and     |     |                                   |
|     exception item        |     |                                   |
|     reports.              |     |                                   |
|                           |     |                                   |
| -   Accounting            |     |                                   |
|     periodically          |     |                                   |
|     reconciles accounts   |     |                                   |
|     used to control       |     |                                   |
|     rejects, adjustments, |     |                                   |
|     and unposted items.   |     |                                   |
+---------------------------+-----+-----------------------------------+
| 2.  Assess the adequacy   |     |                                   |
|     of the daily          |     |                                   |
|     settlement process    |     |                                   |
|     for institutions      |     |                                   |
|     participating in      |     |                                   |
|     shared EFT/POS        |     |                                   |
|     networks or gateway   |     |                                   |
|     systems.              |     |                                   |
+---------------------------+-----+-----------------------------------+
| 3.  Assess the adequacy   |     |                                   |
|     of transaction        |     |                                   |
|     reconstruction        |     |                                   |
|     procedures.           |     |                                   |
|     Transaction files     |     |                                   |
|     should be duplicated  |     |                                   |
|     or otherwise retained |     |                                   |
|     for a minimum of 60   |     |                                   |
|     days as required by   |     |                                   |
|     Regulation E in order |     |                                   |
|     to identify           |     |                                   |
|     unauthorized          |     |                                   |
|     transactions.         |     |                                   |
+---------------------------+-----+-----------------------------------+
| 4.  Assess the adequacy   |     |                                   |
|     of the investigative  |     |                                   |
|     unit in place to      |     |                                   |
|     address customer      |     |                                   |
|     inquiries and control |     |                                   |
|     nonposted items,      |     |                                   |
|     rejects, and          |     |                                   |
|     differences.          |     |                                   |
|     Management should     |     |                                   |
|     periodically receive  |     |                                   |
|     aging reports that    |     |                                   |
|     list outstanding      |     |                                   |
|     items.                |     |                                   |
+---------------------------+-----+-----------------------------------+
| 5.  Assess the separation |     |                                   |
|     of duties for the     |     |                                   |
|     bankcard and EFT/POS  |     |                                   |
|     account posting       |     |                                   |
|     process including     |     |                                   |
|     receipt of            |     |                                   |
|     transactions, file    |     |                                   |
|     updates, adjustments, |     |                                   |
|     internal              |     |                                   |
|     reconcilement,        |     |                                   |
|     preparation of        |     |                                   |
|     general ledger        |     |                                   |
|     entries, posting to   |     |                                   |
|     customers accounts,   |     |                                   |
|     investigations, and   |     |                                   |
|     reconcilement with    |     |                                   |
|     third-party service   |     |                                   |
|     provider network      |     |                                   |
|     switches and card     |     |                                   |
|     processors.           |     |                                   |
+---------------------------+-----+-----------------------------------+
| 6.  Assess the            |     |                                   |
|     effectiveness and     |     |                                   |
|     accuracy of the       |     |                                   |
|     adjustment process    |     |                                   |
|     (e.g., changes to     |     |                                   |
|     deposits and          |     |                                   |
|     reversals) relating   |     |                                   |
|     to retail EFT/POS and |     |                                   |
|     bankcard transactions |     |                                   |
|     processed by staff.   |     |                                   |
+---------------------------+-----+-----------------------------------+
| 7.  For institutions      |     |                                   |
|     involved in bankcard  |     |                                   |
|     issuing or acquiring  |     |                                   |
|     services, consider if |     |                                   |
|     the institution has   |     |                                   |
|     established:          |     |                                   |
|                           |     |                                   |
| -   Proper accounting     |     |                                   |
|     controls for the      |     |                                   |
|     balancing, settling,  |     |                                   |
|     and reconciliation of |     |                                   |
|     all bankcard and      |     |                                   |
|     acquiring accounts    |     |                                   |
|     under its control.    |     |                                   |
|                           |     |                                   |
| -   Appropriate credit    |     |                                   |
|     and liquidity risk    |     |                                   |
|     measures for the      |     |                                   |
|     bankcard and          |     |                                   |
|     acquiring business    |     |                                   |
|     lines.                |     |                                   |
|                           |     |                                   |
| -   Appropriate controls  |     |                                   |
|     for the processing of |     |                                   |
|     customer or merchant  |     |                                   |
|     transaction flows.    |     |                                   |
+---------------------------+-----+-----------------------------------+
| Objective 7: EFT/POS      |     |                                   |
| Operational Controls      |     |                                   |
+---------------------------+-----+-----------------------------------+
| 1.  Assess the            |     |                                   |
|     effectiveness of      |     |                                   |
|     personnel responsible |     |                                   |
|     for internal ATM      |     |                                   |
|     processing. Consider  |     |                                   |
|     whether there are:    |     |                                   |
|                           |     |                                   |
| -   Controls prohibiting  |     |                                   |
|     staff members who     |     |                                   |
|     originate entries     |     |                                   |
|     from processing and   |     |                                   |
|     physically handling   |     |                                   |
|     cash.                 |     |                                   |
|                           |     |                                   |
| -   Proper control of all |     |                                   |
|     source documents      |     |                                   |
|     (e.g., checks for     |     |                                   |
|     deposit) maintained   |     |                                   |
|     throughout the daily  |     |                                   |
|     processing cycle      |     |                                   |
|     relative to           |     |                                   |
|                           |     |                                   |
| ```{=html}                |     |                                   |
| <!-- -->                  |     |                                   |
| ```                       |     |                                   |
| -   Input preparation,    |     |                                   |
|                           |     |                                   |
| -   Reconcilement of item |     |                                   |
|     counts and totals,    |     |                                   |
|                           |     |                                   |
| -   Output distribution,  |     |                                   |
|     and                   |     |                                   |
|                           |     |                                   |
| -   Storage of the        |     |                                   |
|     instruments.          |     |                                   |
+---------------------------+-----+-----------------------------------+
| 2.  Assess terminal and   |     |                                   |
|     operator              |     |                                   |
|     identification codes  |     |                                   |
|     used for all retail   |     |                                   |
|     ATM and POS           |     |                                   |
|     transactions.         |     |                                   |
+---------------------------+-----+-----------------------------------+
| 3.  Assess controls in    |     |                                   |
|     place to prevent      |     |                                   |
|     customer charges from |     |                                   |
|     exceeding the         |     |                                   |
|     available balance in  |     |                                   |
|     the account or        |     |                                   |
|     approved overdraft    |     |                                   |
|     lines.                |     |                                   |
+---------------------------+-----+-----------------------------------+
| 4.  Assess access         |     |                                   |
|     controls for          |     |                                   |
|     terminals used to     |     |                                   |
|     change customer       |     |                                   |
|     credit lines and      |     |                                   |
|     account information.  |     |                                   |
+---------------------------+-----+-----------------------------------+
| 5.  Assess retail EFT     |     |                                   |
|     equipment keyboards   |     |                                   |
|     or display units to   |     |                                   |
|     ensure that they are  |     |                                   |
|     properly shielded to  |     |                                   |
|     avoid disclosure of   |     |                                   |
|     customer IDs or PINs. |     |                                   |
+---------------------------+-----+-----------------------------------+
| 6.  Assess receipt        |     |                                   |
|     issuance to ensure    |     |                                   |
|     customers receive a   |     |                                   |
|     receipt showing the   |     |                                   |
|     amount, date, time,   |     |                                   |
|     and location for      |     |                                   |
|     retail EFT            |     |                                   |
|     transactions in       |     |                                   |
|     compliance with       |     |                                   |
|     Regulation E.         |     |                                   |
+---------------------------+-----+-----------------------------------+
| 7.  Assess whether each   |     |                                   |
|     retail EFT            |     |                                   |
|     transaction is        |     |                                   |
|     assigned a sequence   |     |                                   |
|     number and terminal   |     |                                   |
|     ID to provide an      |     |                                   |
|     audit trail.          |     |                                   |
+---------------------------+-----+-----------------------------------+
| 8.  Assess whether the    |     |                                   |
|     institution regularly |     |                                   |
|     updates hot card or   |     |                                   |
|     customer suspect      |     |                                   |
|     lists and distributes |     |                                   |
|     them to branch        |     |                                   |
|     banking locations.    |     |                                   |
+---------------------------+-----+-----------------------------------+
| 9.  Assess verification   |     |                                   |
|     procedures for        |     |                                   |
|     telephone-instructed  |     |                                   |
|     payments or transfers |     |                                   |
|     and ensure            |     |                                   |
|     confirmations are     |     |                                   |
|     promptly sent to      |     |                                   |
|     customers and         |     |                                   |
|     merchants.            |     |                                   |
+---------------------------+-----+-----------------------------------+
| 10. Assess security       |     |                                   |
|     devices and access    |     |                                   |
|     control procedures    |     |                                   |
|     for EFT/POS,          |     |                                   |
|     bankcard, and         |     |                                   |
|     acquiring processing  |     |                                   |
|     facilities to ensure  |     |                                   |
|     appropriate physical  |     |                                   |
|     and logical access    |     |                                   |
|     controls are in       |     |                                   |
|     place.                |     |                                   |
+---------------------------+-----+-----------------------------------+
| Objective 8: ACH ODFI and |     |                                   |
| RDFI Responsibilities     |     |                                   |
+---------------------------+-----+-----------------------------------+
| 1.  Determine if          |     |                                   |
|     agreements between    |     |                                   |
|     the ODFI and          |     |                                   |
|     originators           |     |                                   |
|     adequately address    |     |                                   |
|                           |     |                                   |
| -   Liabilities and       |     |                                   |
|     warranties,           |     |                                   |
|                           |     |                                   |
| -   Responsibilities for  |     |                                   |
|     processing            |     |                                   |
|     arrangements, and     |     |                                   |
|                           |     |                                   |
| -   Other originator      |     |                                   |
|     obligations such as   |     |                                   |
|     security and audit    |     |                                   |
|     requirements.         |     |                                   |
+---------------------------+-----+-----------------------------------+
| 2.  Determine if the ODFI |     |                                   |
|     has established       |     |                                   |
|     procedures to monitor |     |                                   |
|     the creditworthiness  |     |                                   |
|     of its originator     |     |                                   |
|     customers on an       |     |                                   |
|     ongoing basis.        |     |                                   |
|     Consider whether:     |     |                                   |
|                           |     |                                   |
| -   The ODFI assigns      |     |                                   |
|     credit ratings to     |     |                                   |
|     originators.          |     |                                   |
|                           |     |                                   |
| -   Competent credit      |     |                                   |
|     personnel perform     |     |                                   |
|     monitoring,           |     |                                   |
|     independent of ACH    |     |                                   |
|     operations.           |     |                                   |
|                           |     |                                   |
| -   Written agreements    |     |                                   |
|     with originators      |     |                                   |
|     require the           |     |                                   |
|     submission of         |     |                                   |
|     periodic financial    |     |                                   |
|     information.          |     |                                   |
+---------------------------+-----+-----------------------------------+
| 3.  Determine if the ODFI |     |                                   |
|     has established ACH   |     |                                   |
|     exposure limits for   |     |                                   |
|     originators. Consider |     |                                   |
|     whether:              |     |                                   |
|                           |     |                                   |
| -   The limit is based on |     |                                   |
|     the originator\'s     |     |                                   |
|     credit rating and     |     |                                   |
|     activity levels.      |     |                                   |
|                           |     |                                   |
| -   The limit is          |     |                                   |
|     reasonable relative   |     |                                   |
|     to the originator's   |     |                                   |
|     exposure across all   |     |                                   |
|     services (lending,    |     |                                   |
|     cash management,      |     |                                   |
|     foreign exchange,     |     |                                   |
|     etc.).                |     |                                   |
|                           |     |                                   |
| -   Limits have been      |     |                                   |
|     established for       |     |                                   |
|     originators whose     |     |                                   |
|     entries are           |     |                                   |
|     transmitted to the    |     |                                   |
|     ACH operator by a     |     |                                   |
|     service provider.     |     |                                   |
|                           |     |                                   |
| -   Written agreements    |     |                                   |
|     with originators      |     |                                   |
|     address exposure      |     |                                   |
|     limits.               |     |                                   |
|                           |     |                                   |
| -   A separate limit for  |     |                                   |
|     WEB entries and other |     |                                   |
|     high-risk ACH         |     |                                   |
|     transactions, as      |     |                                   |
|     warranted, have been  |     |                                   |
|     established.          |     |                                   |
+---------------------------+-----+-----------------------------------+
| 4.  Determine if the ODFI |     |                                   |
|     reviews exposure      |     |                                   |
|     limits periodically.  |     |                                   |
|     Consider whether:     |     |                                   |
|                           |     |                                   |
| -   The ODFI adjust       |     |                                   |
|     limits for changes in |     |                                   |
|     an originator's       |     |                                   |
|     credit rating and     |     |                                   |
|     activity levels.      |     |                                   |
|                           |     |                                   |
| -   Increases in an       |     |                                   |
|     originator's ACH      |     |                                   |
|     debit return volume   |     |                                   |
|     trigger a             |     |                                   |
|     re-evaluation of the  |     |                                   |
|     exposure limit.       |     |                                   |
|                           |     |                                   |
| -   The ODFI reviews the  |     |                                   |
|     limits in conjunction |     |                                   |
|     with the review of an |     |                                   |
|     originator's exposure |     |                                   |
|     limit across all      |     |                                   |
|     services.             |     |                                   |
+---------------------------+-----+-----------------------------------+
| 5.  Determine if the ODFI |     |                                   |
|     has implemented       |     |                                   |
|     procedures to monitor |     |                                   |
|     ACH entries initiated |     |                                   |
|     by an originator      |     |                                   |
|     relative to its       |     |                                   |
|     exposure limit across |     |                                   |
|     multiple settlement   |     |                                   |
|     dates. Consider       |     |                                   |
|     whether:              |     |                                   |
|                           |     |                                   |
| -   The monitoring system |     |                                   |
|     is automated and      |     |                                   |
|     accumulates entries   |     |                                   |
|     for a period at least |     |                                   |
|     as long as the        |     |                                   |
|     average ACH debit     |     |                                   |
|     return time (60--75   |     |                                   |
|     days).                |     |                                   |
|                           |     |                                   |
| -   Entries in excess of  |     |                                   |
|     the exposure limit    |     |                                   |
|     receive prior         |     |                                   |
|     approval from a       |     |                                   |
|     credit officer.       |     |                                   |
|                           |     |                                   |
| -   WEB entries and other |     |                                   |
|     high-risk ACH         |     |                                   |
|     transactions (as      |     |                                   |
|     warranted) are        |     |                                   |
|     separately            |     |                                   |
|     accumulated and       |     |                                   |
|     monitored, yet        |     |                                   |
|     integrated into the   |     |                                   |
|     overall ACH           |     |                                   |
|     transaction           |     |                                   |
|     monitoring system.    |     |                                   |
+---------------------------+-----+-----------------------------------+
| 6.  Assess the RDFI's     |     |                                   |
|     overdraft and funds   |     |                                   |
|     availability policies |     |                                   |
|     and practices and     |     |                                   |
|     determine if they     |     |                                   |
|     adequately mitigate   |     |                                   |
|     its credit exposures  |     |                                   |
|     to ACH transactions.  |     |                                   |
+---------------------------+-----+-----------------------------------+
| 7.  Determine the ODFI's  |     |                                   |
|     practices regarding   |     |                                   |
|     originators' annual   |     |                                   |
|     or more frequent      |     |                                   |
|     security audits of    |     |                                   |
|     physical, logical,    |     |                                   |
|     and network security. |     |                                   |
|     Consider whether:     |     |                                   |
|                           |     |                                   |
| -   The ODFI receives     |     |                                   |
|     summaries or full     |     |                                   |
|     audit reports from    |     |                                   |
|     the originators.      |     |                                   |
|                           |     |                                   |
| -   The audits are        |     |                                   |
|     adequate in scope and |     |                                   |
|     performed by          |     |                                   |
|     independent and       |     |                                   |
|     qualified personnel.  |     |                                   |
|                           |     |                                   |
| -   Corrective actions    |     |                                   |
|     regarding exceptions  |     |                                   |
|     are satisfactory.     |     |                                   |
+---------------------------+-----+-----------------------------------+
| 8.  Determine how the     |     |                                   |
|     ODFI or RDFI manages  |     |                                   |
|     its relationship with |     |                                   |
|     third-party service   |     |                                   |
|     providers. Consider   |     |                                   |
|     whether:              |     |                                   |
|                           |     |                                   |
| -   The service           |     |                                   |
|     provider's financial  |     |                                   |
|     information is        |     |                                   |
|     obtained and          |     |                                   |
|     satisfactorily        |     |                                   |
|     analyzed.             |     |                                   |
|                           |     |                                   |
| -   Service-level         |     |                                   |
|     agreements are        |     |                                   |
|     established and       |     |                                   |
|     monitored.            |     |                                   |
+---------------------------+-----+-----------------------------------+
| 9.  Determine if the ODFI |     |                                   |
|     allows third-party    |     |                                   |
|     service providers     |     |                                   |
|     direct access to an   |     |                                   |
|     ACH operator.         |     |                                   |
|     Consider whether      |     |                                   |
|     agreements between    |     |                                   |
|     the ODFI and the      |     |                                   |
|     service providers     |     |                                   |
|     include:              |     |                                   |
|                           |     |                                   |
| -   A requirement that    |     |                                   |
|     the service provider  |     |                                   |
|     obtain the prior      |     |                                   |
|     approval of the ODFI  |     |                                   |
|     before originating    |     |                                   |
|     ACH transactions for  |     |                                   |
|     originators under the |     |                                   |
|     ODFI routing number.  |     |                                   |
|                           |     |                                   |
| -   The establishment by  |     |                                   |
|     the ODFI of dollar    |     |                                   |
|     limits for files that |     |                                   |
|     the service provider  |     |                                   |
|     deposits with the ACH |     |                                   |
|     operator.             |     |                                   |
|                           |     |                                   |
| -   A provision that      |     |                                   |
|     restricts the service |     |                                   |
|     provider's ability to |     |                                   |
|     initiate corrections  |     |                                   |
|     to files that have    |     |                                   |
|     already been          |     |                                   |
|     transmitted to the    |     |                                   |
|     ACH operator.         |     |                                   |
|                           |     |                                   |
| -   Provisions regarding  |     |                                   |
|     warranty and          |     |                                   |
|     liability             |     |                                   |
|     responsibilities.     |     |                                   |
|                           |     |                                   |
| -   Appropriate handling  |     |                                   |
|     of files (physical    |     |                                   |
|     and logical access    |     |                                   |
|     controls).            |     |                                   |
+---------------------------+-----+-----------------------------------+
| 10. Determine whether the |     |                                   |
|     RDFI has established  |     |                                   |
|     procedures to deal    |     |                                   |
|     with consumers'       |     |                                   |
|     notifications         |     |                                   |
|     regarding             |     |                                   |
|     unauthorized or       |     |                                   |
|     improperly originated |     |                                   |
|     entries or entries    |     |                                   |
|     where authorization   |     |                                   |
|     was revoked.          |     |                                   |
+---------------------------+-----+-----------------------------------+
| 11. Determine if the RDFI |     |                                   |
|     acts promptly on      |     |                                   |
|     consumers'            |     |                                   |
|     stop-payment orders.  |     |                                   |
+---------------------------+-----+-----------------------------------+
| 12. Determine if the RDFI |     |                                   |
|     has procedures that   |     |                                   |
|     enable it to freeze   |     |                                   |
|     proceeds of ACH       |     |                                   |
|     transactions in favor |     |                                   |
|     of blocked parties    |     |                                   |
|     (under OFAC           |     |                                   |
|     sanctions) for whom   |     |                                   |
|     the RDFI holds an     |     |                                   |
|     account.              |     |                                   |
+---------------------------+-----+-----------------------------------+
| 13. Determine if the      |     |                                   |
|     financial institution |     |                                   |
|     considers the volume  |     |                                   |
|     of its uncollected    |     |                                   |
|     ACH transactions as   |     |                                   |
|     part of its liquidity |     |                                   |
|     risk management       |     |                                   |
|     practices.            |     |                                   |
+---------------------------+-----+-----------------------------------+
| 14. Determine if          |     |                                   |
|     management and        |     |                                   |
|     personnel display     |     |                                   |
|     adequate knowledge    |     |                                   |
|     and technical skills  |     |                                   |
|     in managing and       |     |                                   |
|     performing duties     |     |                                   |
|     related to ACH        |     |                                   |
|     transactions.         |     |                                   |
+---------------------------+-----+-----------------------------------+
| 15. Review results from   |     |                                   |
|     the financial         |     |                                   |
|     institution's NACHA   |     |                                   |
|     rule compliance       |     |                                   |
|     audit. Determine:     |     |                                   |
|                           |     |                                   |
| -   The independence and  |     |                                   |
|     competence of the     |     |                                   |
|     party performing the  |     |                                   |
|     audit.                |     |                                   |
|                           |     |                                   |
| -   Whether the board or  |     |                                   |
|     its committee         |     |                                   |
|     reviewed and approved |     |                                   |
|     the audit.            |     |                                   |
|                           |     |                                   |
| -   Whether               |     |                                   |
|     responsibilities for  |     |                                   |
|     high-risk entries,    |     |                                   |
|     such as WEB, were     |     |                                   |
|     included in the       |     |                                   |
|     scope.                |     |                                   |
|                           |     |                                   |
| -   Whether corrective    |     |                                   |
|     actions are           |     |                                   |
|     satisfactory          |     |                                   |
|     regarding any audit   |     |                                   |
|     exceptions.           |     |                                   |
+---------------------------+-----+-----------------------------------+
| Objective 9: ACH          |     |                                   |
| Accounting and            |     |                                   |
| Transaction Processing    |     |                                   |
+---------------------------+-----+-----------------------------------+
|                           |     |                                   |
+---------------------------+-----+-----------------------------------+
| 1.  Assess adequacy of    |     |                                   |
|     logs maintained for   |     |                                   |
|     ACH payments received |     |                                   |
|     from and delivered to |     |                                   |
|     each customer.        |     |                                   |
+---------------------------+-----+-----------------------------------+
| 2.  Assess the balancing  |     |                                   |
|     procedures used for   |     |                                   |
|     all ACH payments      |     |                                   |
|     received and whether  |     |                                   |
|     they include          |     |                                   |
|     balancing to the      |     |                                   |
|     aggregate payments    |     |                                   |
|     sent to an ACH        |     |                                   |
|     operator.             |     |                                   |
+---------------------------+-----+-----------------------------------+
| 3.  Assess whether the    |     |                                   |
|     institution balances  |     |                                   |
|     all payments received |     |                                   |
|     from an ACH operator  |     |                                   |
|     to the aggregate of   |     |                                   |
|     payments delivered to |     |                                   |
|     customers.            |     |                                   |
+---------------------------+-----+-----------------------------------+
| 4.  Assess whether the    |     |                                   |
|     institution verifies  |     |                                   |
|     and authorizes the    |     |                                   |
|     source of all ACH     |     |                                   |
|     files received for    |     |                                   |
|     processing.           |     |                                   |
+---------------------------+-----+-----------------------------------+
| 5.  Assess whether the    |     |                                   |
|     institution           |     |                                   |
|     reconciles all        |     |                                   |
|     general ledger        |     |                                   |
|     accounts related to   |     |                                   |
|     ACH on a timely       |     |                                   |
|     basis.                |     |                                   |
+---------------------------+-----+-----------------------------------+
| 6.  Assess whether ACH    |     |                                   |
|     supervisory personnel |     |                                   |
|     perform reconcilement |     |                                   |
|     and regularly review  |     |                                   |
|     exception items.      |     |                                   |
+---------------------------+-----+-----------------------------------+
| 7.  Assess whether the    |     |                                   |
|     institution           |     |                                   |
|     reconciles the ACH    |     |                                   |
|     activity and pending  |     |                                   |
|     file totals daily     |     |                                   |
|     with the ACH          |     |                                   |
|     operator.             |     |                                   |
+---------------------------+-----+-----------------------------------+
| 8.  Assess the            |     |                                   |
|     effectiveness of the  |     |                                   |
|     reconcilement with    |     |                                   |
|     third-party           |     |                                   |
|     processors preparing  |     |                                   |
|     ACH transaction files |     |                                   |
|     and ensure daily      |     |                                   |
|     reconciliation.       |     |                                   |
+---------------------------+-----+-----------------------------------+
| 9.  Assess the            |     |                                   |
|     effectiveness of ACH  |     |                                   |
|     holdover transactions |     |                                   |
|     and determine whether |     |                                   |
|     the institution       |     |                                   |
|     adequately controls   |     |                                   |
|     them.                 |     |                                   |
+---------------------------+-----+-----------------------------------+
| 10. Assess whether        |     |                                   |
|     accounting staff      |     |                                   |
|     reconciles individual |     |                                   |
|     outgoing ACH batches  |     |                                   |
|     before merging them   |     |                                   |
|     with other ACH        |     |                                   |
|     transactions.         |     |                                   |
+---------------------------+-----+-----------------------------------+
| 11. Determine whether     |     |                                   |
|     there are separate    |     |                                   |
|     accounts to control   |     |                                   |
|     holdovers,            |     |                                   |
|     adjustments, return   |     |                                   |
|     items, rejects, etc.  |     |                                   |
|     and whether they are  |     |                                   |
|     periodically          |     |                                   |
|     reconciled.           |     |                                   |
+---------------------------+-----+-----------------------------------+
| 12. Assess the            |     |                                   |
|     effectiveness of the  |     |                                   |
|     investigation unit to |     |                                   |
|     address customer      |     |                                   |
|     inquiries and control |     |                                   |
|     return items,         |     |                                   |
|     rejected/unposted     |     |                                   |
|     items, differences,   |     |                                   |
|     etc. Determine        |     |                                   |
|     whether the unit      |     |                                   |
|     periodically          |     |                                   |
|     generates aging       |     |                                   |
|     reports of            |     |                                   |
|     outstanding items for |     |                                   |
|     management.           |     |                                   |
+---------------------------+-----+-----------------------------------+
| 13. Assess whether        |     |                                   |
|     management adequately |     |                                   |
|     tracks exceptions to  |     |                                   |
|     credit limit policies |     |                                   |
|     and legal contracts.  |     |                                   |
+---------------------------+-----+-----------------------------------+
| 14. Determine whether     |     |                                   |
|     exception reports     |     |                                   |
|     (e.g., rejects,       |     |                                   |
|     return items, and     |     |                                   |
|     aging of open items)  |     |                                   |
|     receive appropriate   |     |                                   |
|     management attention. |     |                                   |
+---------------------------+-----+-----------------------------------+
| 15. Assess the adequacy   |     |                                   |
|     of separation of      |     |                                   |
|     duties throughout the |     |                                   |
|     ACH process including |     |                                   |
|     origination, data     |     |                                   |
|     entry, adjustments,   |     |                                   |
|     internal              |     |                                   |
|     reconcilement,        |     |                                   |
|     preparing general     |     |                                   |
|     ledger entries,       |     |                                   |
|     posting to customer   |     |                                   |
|     accounts,             |     |                                   |
|     investigations, and   |     |                                   |
|     reconcilement with    |     |                                   |
|     ACH operators.        |     |                                   |
+---------------------------+-----+-----------------------------------+
| 16. Assess whether        |     |                                   |
|     adjustments (e.g.,    |     |                                   |
|     added payments, stop  |     |                                   |
|     payments, reroutes,   |     |                                   |
|     and reversals) to     |     |                                   |
|     original ACH          |     |                                   |
|     instructions are      |     |                                   |
|     received in an area   |     |                                   |
|     that does not have    |     |                                   |
|     access to the         |     |                                   |
|     original data files.  |     |                                   |
+---------------------------+-----+-----------------------------------+
| 17. Assess whether        |     |                                   |
|     controls are          |     |                                   |
|     appropriate for the   |     |                                   |
|     adjustment process,   |     |                                   |
|     including             |     |                                   |
|     authorization (e.g.,  |     |                                   |
|     signature             |     |                                   |
|     verification and      |     |                                   |
|     callbacks on          |     |                                   |
|     telephone             |     |                                   |
|     instructions) and     |     |                                   |
|     whether the           |     |                                   |
|     institution maintains |     |                                   |
|     adequate records      |     |                                   |
|     (e.g., logs and       |     |                                   |
|     taping of telephone   |     |                                   |
|     calls) of individuals |     |                                   |
|     making requests.      |     |                                   |
+---------------------------+-----+-----------------------------------+
| 18. Assess the customer   |     |                                   |
|     profile origination   |     |                                   |
|     and change request    |     |                                   |
|     process. Consider     |     |                                   |
|     whether requests:     |     |                                   |
|                           |     |                                   |
| -   Are in writing or     |     |                                   |
|     equivalent            |     |                                   |
|     confirmation for      |     |                                   |
|     on-line activities.   |     |                                   |
|                           |     |                                   |
| -   Identify the          |     |                                   |
|     originating           |     |                                   |
|     personnel.            |     |                                   |
|                           |     |                                   |
| -   Document supervisory  |     |                                   |
|     approval.             |     |                                   |
|                           |     |                                   |
| -   Are verified by staff |     |                                   |
|     unable to make        |     |                                   |
|     changes.              |     |                                   |
+---------------------------+-----+-----------------------------------+
| Objective 10: ACH Funding |     |                                   |
| and Credit                |     |                                   |
+---------------------------+-----+-----------------------------------+
| 1.  Assess the process    |     |                                   |
|     for releasing         |     |                                   |
|     payments to an ACH    |     |                                   |
|     operator, and         |     |                                   |
|     determine that        |     |                                   |
|     assurances are        |     |                                   |
|     obtained that         |     |                                   |
|     sufficient collected  |     |                                   |
|     funds (e.g., on       |     |                                   |
|     deposit or            |     |                                   |
|     pre-funded) or credit |     |                                   |
|     facilities are        |     |                                   |
|     available. The        |     |                                   |
|     institution should    |     |                                   |
|     monitor customer      |     |                                   |
|     intraday and interday |     |                                   |
|     positions based on    |     |                                   |
|     defined thresholds.   |     |                                   |
+---------------------------+-----+-----------------------------------+
| 2.  For third-party       |     |                                   |
|     processors contracted |     |                                   |
|     to process outgoing   |     |                                   |
|     ACH transactions,     |     |                                   |
|     determine whether     |     |                                   |
|     there are procedures  |     |                                   |
|     to monitor ACH        |     |                                   |
|     activity and ensure   |     |                                   |
|     that funds are        |     |                                   |
|     collected (collected  |     |                                   |
|     balances, prefunding, |     |                                   |
|     credit lines) before  |     |                                   |
|     the institution       |     |                                   |
|     settles with the ACH  |     |                                   |
|     operator.             |     |                                   |
+---------------------------+-----+-----------------------------------+
| 3.  For prefunding        |     |                                   |
|     arrangements in place |     |                                   |
|     for customers without |     |                                   |
|     credit lines,         |     |                                   |
|     determine if          |     |                                   |
|     management blocks     |     |                                   |
|     funds (held for       |     |                                   |
|     disposition) or       |     |                                   |
|     maintains them in     |     |                                   |
|     separate accounts     |     |                                   |
|     until the transaction |     |                                   |
|     date.                 |     |                                   |
+---------------------------+-----+-----------------------------------+
| 4.  For non pre-funded    |     |                                   |
|     arrangements, the     |     |                                   |
|     institution should    |     |                                   |
|     place blocks on       |     |                                   |
|     outgoing payments to  |     |                                   |
|     deposit accounts,     |     |                                   |
|     apply them as         |     |                                   |
|     reductions to credit  |     |                                   |
|     lines, or include     |     |                                   |
|     them in the overall   |     |                                   |
|     funds transfer        |     |                                   |
|     monitoring process.   |     |                                   |
+---------------------------+-----+-----------------------------------+
| 5.  Assess whether        |     |                                   |
|     management approves   |     |                                   |
|     payments resulting in |     |                                   |
|     extensions of credit  |     |                                   |
|     lines or drawings     |     |                                   |
|     against uncollected   |     |                                   |
|     funds and retains     |     |                                   |
|     documentation to      |     |                                   |
|     support the           |     |                                   |
|     approvals. Determine  |     |                                   |
|     whether the           |     |                                   |
|     institution performs  |     |                                   |
|     credit assessments of |     |                                   |
|     customers originating |     |                                   |
|     large dollar volumes  |     |                                   |
|     of ACH credit         |     |                                   |
|     transactions. Credit  |     |                                   |
|     assessments should    |     |                                   |
|     also be reviewed      |     |                                   |
|     periodically to       |     |                                   |
|     evaluate              |     |                                   |
|     creditworthiness of   |     |                                   |
|     the customer and      |     |                                   |
|     current economic      |     |                                   |
|     conditions.           |     |                                   |
+---------------------------+-----+-----------------------------------+
| 6.  Assess whether        |     |                                   |
|     management treats ACH |     |                                   |
|     debits deposited as   |     |                                   |
|     uncollected funds and |     |                                   |
|     whether they monitor  |     |                                   |
|     any draws against     |     |                                   |
|     these funds for       |     |                                   |
|     debits originated by  |     |                                   |
|     high-risk customers.  |     |                                   |
+---------------------------+-----+-----------------------------------+
| 7.  Assess whether        |     |                                   |
|     management approves   |     |                                   |
|     draws against         |     |                                   |
|     uncollected ACH       |     |                                   |
|     deposits and          |     |                                   |
|     maintains             |     |                                   |
|     documentation to      |     |                                   |
|     support approvals for |     |                                   |
|     debits originated by  |     |                                   |
|     high-risk customers.  |     |                                   |
+---------------------------+-----+-----------------------------------+
| 8.  Assess Internet and   |     |                                   |
|     telephone ACH         |     |                                   |
|     transaction           |     |                                   |
|     processing procedures |     |                                   |
|     and determine whether |     |                                   |
|     there are appropriate |     |                                   |
|     authentication        |     |                                   |
|     controls and          |     |                                   |
|     procedures to ensure  |     |                                   |
|     the proper identities |     |                                   |
|     of parties invoking   |     |                                   |
|     ACH transactions.     |     |                                   |
+---------------------------+-----+-----------------------------------+
| 9.  Assess management's   |     |                                   |
|     risk assessment of    |     |                                   |
|     ACH services in terms |     |                                   |
|     of the importance of  |     |                                   |
|     this function to the  |     |                                   |
|     overall corporate     |     |                                   |
|     treasury services     |     |                                   |
|     function.             |     |                                   |
+---------------------------+-----+-----------------------------------+
| 10. Ensure that the       |     |                                   |
|     financial institution |     |                                   |
|     obtains and analyzes  |     |                                   |
|     any audit conducted   |     |                                   |
|     by the ACH service    |     |                                   |
|     provider, pursuant to |     |                                   |
|     the NACHA rule        |     |                                   |
|     compliance audit      |     |                                   |
|     requirement.          |     |                                   |
+---------------------------+-----+-----------------------------------+
| Objective 11: Web and     |     |                                   |
| Telephone-Initiated ACH   |     |                                   |
| Transactions              |     |                                   |
+---------------------------+-----+-----------------------------------+
| 1.  Determine whether the |     |                                   |
|     financial institution |     |                                   |
|     has adopted adequate  |     |                                   |
|     policies and          |     |                                   |
|     procedures regarding  |     |                                   |
|     ACH transactions      |     |                                   |
|     involving             |     |                                   |
|     Internet-initiated    |     |                                   |
|     (WEB) entries.        |     |                                   |
|     Consider whether      |     |                                   |
|     they:                 |     |                                   |
|                           |     |                                   |
| -   Are in writing and    |     |                                   |
|     are approved by the   |     |                                   |
|     board or a designated |     |                                   |
|     committee.            |     |                                   |
|                           |     |                                   |
| -   Adequately address    |     |                                   |
|     ODFI or RDFI          |     |                                   |
|     responsibilities.     |     |                                   |
|                           |     |                                   |
| -   Establish management  |     |                                   |
|     accountability.       |     |                                   |
|                           |     |                                   |
| -   Include a process to  |     |                                   |
|     monitor policy        |     |                                   |
|     compliance.           |     |                                   |
|                           |     |                                   |
| -   Include a mechanism   |     |                                   |
|     for periodic reviews  |     |                                   |
|     and updates.          |     |                                   |
+---------------------------+-----+-----------------------------------+
| 2.  Determine whether the |     |                                   |
|     ODFI has implemented  |     |                                   |
|     telephone-initiated   |     |                                   |
|     (TEL) ACH entries.    |     |                                   |
|     Consider whether:     |     |                                   |
|                           |     |                                   |
| -   There are significant |     |                                   |
|     return rates for      |     |                                   |
|     these transactions.   |     |                                   |
|                           |     |                                   |
| -   The institution       |     |                                   |
|     adheres to NACHA      |     |                                   |
|     guidelines concerning |     |                                   |
|     merchant management   |     |                                   |
|     and their business    |     |                                   |
|     practices.            |     |                                   |
|                           |     |                                   |
| -   Written agreements    |     |                                   |
|     are in place with all |     |                                   |
|     originators           |     |                                   |
|     submitting TEL        |     |                                   |
|     transactions, and     |     |                                   |
|     include adequate      |     |                                   |
|     consumer (receiver)   |     |                                   |
|     authentication and    |     |                                   |
|     authorization.        |     |                                   |
|                           |     |                                   |
| -   The institution makes |     |                                   |
|     tape recordings of    |     |                                   |
|     all consumer oral     |     |                                   |
|     authorizations. Also  |     |                                   |
|     determine if the      |     |                                   |
|     institution provides  |     |                                   |
|     written notice to the |     |                                   |
|     consumer, prior to    |     |                                   |
|     settlement date for   |     |                                   |
|     the TEL entry,        |     |                                   |
|     confirming the terms  |     |                                   |
|     of the oral           |     |                                   |
|     authorization.        |     |                                   |
+---------------------------+-----+-----------------------------------+
| 3.  Determine if the ODFI |     |                                   |
|     requires its          |     |                                   |
|     originator to employ  |     |                                   |
|     a commercially        |     |                                   |
|     reasonable method to  |     |                                   |
|     authenticate the      |     |                                   |
|     consumer/business.    |     |                                   |
|     Consider whether:     |     |                                   |
|                           |     |                                   |
| -   Documentation of the  |     |                                   |
|     method is adequate.   |     |                                   |
|                           |     |                                   |
| -   The frequency of the  |     |                                   |
|     review of             |     |                                   |
|     commercially          |     |                                   |
|     reasonable standards  |     |                                   |
|     is sufficient.        |     |                                   |
+---------------------------+-----+-----------------------------------+
| 4.  Determine if the ODFI |     |                                   |
|     conducts risk         |     |                                   |
|     assessments of its    |     |                                   |
|     originators and if    |     |                                   |
|     the risk assessments  |     |                                   |
|     reflect a reasonable  |     |                                   |
|     exercise of business  |     |                                   |
|     judgment. Consider    |     |                                   |
|     whether the risk      |     |                                   |
|     assessment includes   |     |                                   |
|     evaluations of:       |     |                                   |
|                           |     |                                   |
| -   Receiver              |     |                                   |
|     authorizations.       |     |                                   |
|                           |     |                                   |
| -   Originator's Internet |     |                                   |
|     security capability,  |     |                                   |
|     including;            |     |                                   |
|                           |     |                                   |
| ```{=html}                |     |                                   |
| <!-- -->                  |     |                                   |
| ```                       |     |                                   |
| -   Commercially          |     |                                   |
|     reasonable fraudulent |     |                                   |
|     transaction detection |     |                                   |
|     systems and routing   |     |                                   |
|     number verification,  |     |                                   |
|                           |     |                                   |
| -   Secure customer       |     |                                   |
|     Internet sessions,    |     |                                   |
|     and                   |     |                                   |
|                           |     |                                   |
| -   Annual (or more       |     |                                   |
|     frequent) security    |     |                                   |
|     audits based on risk. |     |                                   |
|                           |     |                                   |
| ```{=html}                |     |                                   |
| <!-- -->                  |     |                                   |
| ```                       |     |                                   |
| -   Frequency of risk     |     |                                   |
|     assessments.          |     |                                   |
|                           |     |                                   |
| -   Documentation and     |     |                                   |
|     approval standards.   |     |                                   |
+---------------------------+-----+-----------------------------------+
| Objective 12: ACH         |     |                                   |
| Contingency Plans         |     |                                   |
+---------------------------+-----+-----------------------------------+
| 1.  Evaluate the ACH      |     |                                   |
|     contingency plan,     |     |                                   |
|     determine whether the |     |                                   |
|     financial institution |     |                                   |
|     has tested it, and    |     |                                   |
|     determine whether it  |     |                                   |
|     includes provisions   |     |                                   |
|     for partial or        |     |                                   |
|     complete failure of   |     |                                   |
|     the system or         |     |                                   |
|     communication lines   |     |                                   |
|     between the           |     |                                   |
|     institution, ACH      |     |                                   |
|     operators, customers, |     |                                   |
|     and associated data   |     |                                   |
|     centers.              |     |                                   |
+---------------------------+-----+-----------------------------------+
| 2.  Based on the volume   |     |                                   |
|     and importance of ACH |     |                                   |
|     activity, evaluate    |     |                                   |
|     whether the plan is   |     |                                   |
|     reasonable and        |     |                                   |
|     whether it provides   |     |                                   |
|     for a reasonable      |     |                                   |
|     recovery period.      |     |                                   |
+---------------------------+-----+-----------------------------------+
| 3.  Determine if the      |     |                                   |
|     institution           |     |                                   |
|     duplicates or retains |     |                                   |
|     transaction files for |     |                                   |
|     input reconstruction  |     |                                   |
|     for a minimum of 24   |     |                                   |
|     hours. Note that      |     |                                   |
|     NACHA rules require   |     |                                   |
|     the retention of all  |     |                                   |
|     entries, including    |     |                                   |
|     return and adjustment |     |                                   |
|     entries, transmitted  |     |                                   |
|     to and received from  |     |                                   |
|     the ACH for a period  |     |                                   |
|     of six years after    |     |                                   |
|     the date of           |     |                                   |
|     transmittal.          |     |                                   |
+---------------------------+-----+-----------------------------------+
| 4.  Determine if data and |     |                                   |
|     program files are     |     |                                   |
|     adequately retained   |     |                                   |
|     and backed up at      |     |                                   |
|     off‑premises          |     |                                   |
|     facilities.           |     |                                   |
+---------------------------+-----+-----------------------------------+
| 5.  Determine if the      |     |                                   |
|     center has            |     |                                   |
|     established and       |     |                                   |
|     tested procedures to  |     |                                   |
|     recover and restore   |     |                                   |
|     data under various    |     |                                   |
|     contingency           |     |                                   |
|     scenarios.            |     |                                   |
+---------------------------+-----+-----------------------------------+
| 6.  Determine if the      |     |                                   |
|     frequency and methods |     |                                   |
|     of testing            |     |                                   |
|     contingency plans are |     |                                   |
|     adequate.             |     |                                   |
+---------------------------+-----+-----------------------------------+
| Objective                 |     |                                   |
+---------------------------+-----+-----------------------------------+
| 1.  Determine whether the |     |                                   |
|     institution manages   |     |                                   |
|     check return items    |     |                                   |
|     effectively and       |     |                                   |
|     whether there are     |     |                                   |
|     significant numbers   |     |                                   |
|     of return items.      |     |                                   |
+---------------------------+-----+-----------------------------------+
| 2.  Determine if the      |     |                                   |
|     institution records   |     |                                   |
|     source document       |     |                                   |
|     images for recovery   |     |                                   |
|     if the originals are  |     |                                   |
|     lost in transit.      |     |                                   |
+---------------------------+-----+-----------------------------------+
| 3.  Note whether the      |     |                                   |
|     institution           |     |                                   |
|     reconciles batch      |     |                                   |
|     dollar totals after   |     |                                   |
|     processing.           |     |                                   |
+---------------------------+-----+-----------------------------------+
| 4.  Determine whether     |     |                                   |
|     reject items are      |     |                                   |
|     properly segregated   |     |                                   |
|     from other work.      |     |                                   |
+---------------------------+-----+-----------------------------------+
| 5.  Note whether          |     |                                   |
|     exception items are   |     |                                   |
|     adequately controlled |     |                                   |
|     and tracked.          |     |                                   |
+---------------------------+-----+-----------------------------------+
| 6.  Determine whether     |     |                                   |
|     item processing       |     |                                   |
|     duties are            |     |                                   |
|     appropriately         |     |                                   |
|     segregated.           |     |                                   |
+---------------------------+-----+-----------------------------------+

  ----------------------- ----------- ----------- -----------------------
  Examiner                            Date        

                                                  

                                                  

  Reviewer's Initials                             

                                                  
  ----------------------- ----------- ----------- -----------------------