The International ACH - New Risk for Financial Institutions?
For ACH transactions today, compliance with the Office of Foreign Assets Control (OFAC) requires a financial institution to block any transfer to or from an account on its books if that entity is on the Specially Designated Nationals (SDN) list supplied by OFAC. Compliance with OFAC will become much more complex when NACHA implements the International ACH Transaction (IAT Standard Entry Class Code) in March 2009.
An ‘International ACH Transaction’ is defined as an ACH transaction for which at least one processing financial institution or third party is domiciled in the US, and at least one party to the transaction is outside US jurisdiction or a transaction initiated from an originator outside the US with the ACH funds transfer taking place between two domestic financial institutions. An example of this would be a message sent over the SWIFT network.
OFAC administers a series of laws that impose economic sanctions against hostile targets to further US foreign policy and national security objectives. Economic sanctions are powerful foreign policy tools; their success requires the active participation and support of every financial institution. The use of sanctions by the US goes back to the earliest days of the Republic through trade embargoes, blocked asset controls, and other commercial and financial restrictions. Many of them have been accepted within the global community against pariah countries, as well as being used against groups, such as narcotics traffickers and terrorists, who threaten the security, the economy, and safety of the US. Management of sanctions on the US side is entrusted to the Secretary of the Treasury.
The importance of establishing a compliance programme and developing internal audit procedures should be obvious to every financial institution. The OFAC expectations with regard to the processing of transactions involving countries under sanctions are very clear. Financial institutions are required to report all blocked transactions to OFAC within 10 days of occurrence. If your financial institution does not block and report a transfer and another financial institution does, then your financial institution could be fined. A financial institution that is non-compliant may expose itself to adverse publicity, fines and even criminal penalties.
Until recently, complying with OFAC regulations for ACH transactions has been very simple. If the account is on your books, a funds transfer must be blocked and reported to OFAC within 10 days. The announcement by NACHA of the implementation of the International ACH Transaction rule significantly changes the cross-border landscape for every US financial institution. Beginning on 20 March 2009, the Federal Reserve International ACH service will permit, for the first time, inbound credit transfers from Europe, Mexico and Canada. It will now be the responsibility of the receiving depository financial institutions (RDFI) to screen all of the information in an IAT for OFAC compliance.
The new NACHA rule clearly defines, for the first time, what constitutes an International ACH Transaction -the location of the originating party that initiates the payment transaction. Thus, certain transactions currently formatted as domestic transactions, but that are in fact international transactions, will need to be sent as IATs. The new rule also requires originating financial institutions to supply a substantial amount of new information about the originator and the beneficiary. The inclusion of the ‘travel rule’ information – originator name, address, account number; originator’s depository institution name and payment amount; beneficiary name, address, account number; and the beneficiary’s financial institution – will assist RDFIs with the screening. With the addition of the new information, international ACH transactions will require the same OFAC screening techniques as wire transfers.
The ‘travel rule’ information will be contained in addenda records of the ACH transactions requiring ACH operators, financial institutions and providers of ACH software to make extensive changes to accommodate the IAT requirements.
Once the new rule is implemented, RDFIs must screen every IAT transaction they receive against the OFAC SDN list. Transactions that are identified as suspect transactions must be thoroughly investigated. A financial institution that suspects that information in the transaction matches information in the OFAC SDN list must immediately freeze the funds and report the transaction to OFAC for final disposition.
This will be the first time that RDFIs will be required to screen incoming international ACH transactions for OFAC compliance. Very few RDFIs have the tools in place to perform OFAC screening for ACH transactions today and it is clear that they will need to invest in the proper tools and trained personnel to screen these transactions.
OFAC has a reputation of working with financial institutions that miss a transaction that should have been blocked if the financial institutions have the proper procedures in place, but have very little tolerance for a financial institution that has not taken the appropriate steps to ensure compliance with OFAC regulations.
The non-compliance risks are substantial, heavy fines, adverse publicity for the institution and the possibility of criminal prosecution. None of these risks should be taken lightly.
The NACHA IAT rule makes it incumbent on all financial institutions to acquire OFAC screening software tools or a service provider that will provide the screening service. A screening package for a large institution can cost up to US$250,000 but let’s take a very conservative average of US$5000 for the package or service that would accumulate the expense over time. Multiply US$5000 by the number of financial institutions (banks and credit unions) in the US – approximately 13,000 – results in a monitoring cost of US$65m, which does not include the cost of software changes for ACH operators, originating financial institutions and receiving financial institutions.
Centralised OFAC screening services should be offered by the ACH operators -the Federal Reserve Banks – FedACH and the Clearing House Payments Co – Electronic Payments Network (EPN). A centralised service from the operators would be more practical and cost effective than for each institution to search for and acquire a unique solution. Centralise screening would produce higher quality results and would be uniform across the industry. The EPN offers a centralised OFAC screening service that will have to be modified to meet the new requirements. The Federal Reserve should offer a similar service, especially in light of the fact that the main beneficiary of international ACH is the FedACH International Service.
The time for determining what approach to take is now, implementation of the new rule is only 14 months away so it is definitely not too early for an RDFI to begin investigating how they will accommodate these new requirements. Finding the right solution to fit its needs is of primary importance. This new application will add a new compliance requirement -one that if it is not addressed appropriately can have dire consequences for a financial institution.