ACH fraud: Lessons for AML programs from a recent court case

The credit union has appealed the decision to the U.S. Fourth Circuit Court of Appeals. Nevertheless, the case provides several valuable lessons for BSA Officers and financial institutions’ AML/CFT and fraud programs.

1. Watch for red flags in ACH Standard Entry Class codes. Detecting and swiftly acting upon mismatches in beneficiaries and ACH Standard Entry Class Codes (SEC) is critical in order to detect fraud. There were four substantial ACH payments from the construction company intended for one of their suppliers. The beneficiary account, however, was an individual personal account, which should have been an immediate red flag. Another red flag: each ACH payment contained the SEC of CCD (Cash Concentration Disbursement) which should only be used with corporate credits and debits to commercial business accounts.
2. ACH warnings/exceptions matter. Don’t ignore warnings and exceptions generated from the ACH system. Often, those alerts mostly likely are routed to the operations area of the financial institution. The BSA/AML staff should ensure that they promptly review these alerts, which are constantly being triggered. Although this task is not typically directly under the BSA/AML umbrella the ACH function is part of the FI’s program.
3. Raise your hand about ACH risks. If ACH system alerts are not being reviewed in a timely manner, speak up. The operations area should communicate with the BSA/AML area if this function is failing. The financial institution’s Chief Operating Officer and/or the BSA/AML Officer should alert and escalate this situation to the attention of the bank’s Chief Executive Officer and Board of Directors.
4. Short staffing is no excuse. If staffing shortages are an issue, prioritize the most important alert types and frequency. In this case, the ACH system generated both exceptions and warnings with the former being the most serious and requiring manual intervention. However, for mismatched SEC codes, only warnings are generated. A system that could notify the financial institution when a particular account is generating more than one warning in a specified time frame could help trigger timely staff review. In this case, however, the court said the credit union “failed to establish a reasonable routine to monitor alerts that warned of suspicious activity” regarding the account.
5. Monitor new account velocity. Pay attention to new accounts with high-velocity transactions. In this case, the member was not new, but the account was. The member also offered an illogical reason for opening the account, which should have raised another fraud red flag.  Once the account was open the ACH payments were deposited, and the funds withdrawn through various methods. If a rules-based monitoring system had been in place the scenarios would have alerted for the high velocity and the significant amounts of the incoming transactions into a new account. Also, be sure your system includes new accounts in its monitoring and not just new members or customers.
6. Optimize your monitoring system. Review the scenario parameters and default settings of the rules-based monitoring AML software system. Default settings are designed to be generally effective for most software customers. However, AML system optimization, or parameter tuning, is critical for monitoring to be risk-based and the most effective for your FI’s market, products, and customer or member base. A robust model validation program to independently review these settings should be part of the compliance program and your institution’s model risk management.