EIP Risk Management and Compliance Implications

Economic Impact Payments (EIP) Risk Management and Compliance Implications

In this unprecedented time generated by the economic impact to the country of the COVID-19 virus and actions taken by the government, Members should consider how they will address some specific risks that arise from the receipt of these payments. NEACH has investigated the various risks within the ACH Network and determined the issues and their impact. Please consider these risks when handling EIPs.

NEACH has also compiled a list of Economic Impact Payments (EIPs) FAQs based on the latest information we have. Access the FAQs.

GENERAL

Compliance and risk professionals should consult with their legal counsel and operational staff to consider the operational implications of EIPs.

Treasury will be treating these payments as if they were tax refunds with all the accompanying rules. The processing of Federal tax refunds has very specific liabilities assigned. There are three potential scenarios:

If the tax-preparer or taxpayer makes an error, the tax-preparer or taxpayer will be responsible; the government will not help.
If the financial institution moves the Entry to an account other than the account identified in the Entry, the government will not help, and the RDFI will be liable.
If the IRS makes an error, the government will help with resolving the error.

If your institution returns an EIP ACH Direct Deposit, that payment will be redistributed as a check payment by the Treasury.

Payments, both via ACH and Check, will be distributed in weekly cycles. There is no current list of when a specific payment will be distributed.

Risks

Operational Risks – Your institution has standard policies and procedures on processing ACH payments and specifically, tax refunds. These payments should follow these standard procedures with particular attention paid to unique situations with the goal of providing EIPs to consumers.

IMPACT spacespacespacespacespace	ISSUE spacespacespacespace
Medium	Closed Accounts – Some entries may reject if the account is closed. Your institution should consider if you have the ability to identify if the closed account is for an account holder who opened a different account, or has left the institution. It may be difficult to explain to a current account holder that the payment was received and returned. Accounts for existing customers may have changed for any number of reasons, including internal changes made to the core since the person filed either his or her 2018 or 2019 tax returns. Changes related to your core system that caused them not to get paid would be even more difficult to explain. As mentioned above, any returned EIP will be redistributed via check.
Medium	Deceased Account holders – These payments should be handled in your institution’s usual manner. EIPs are NOT subject to reclamation, so the institution would not be liable to Treasury for the reclamation of these payments.
High	Social Security Number – we have been informed that unlike other payments, these EIPs will have Social Security Numbers included in the payment. Review of your online and paper statements creation should take care to not share this information unmasked in any distribution. Please note some FIs limit mobile and online banking services to reviewing of statements. FIs need to ensure that if they are passing the Social Security Number along on the statement, the level of security for on-line banking and mobile banking may need to be increased, as the level of risk for this limited use would be increased.

Credit Risk – Credit Risk would indicate a situation where the institution would be liable financially for the EIP. This is credit risk as a result of an Operational error. Care should be paid to the institution's use of “swap” tables, in which an Entry automatically gets moved to a new, different account.

IMPACT spacespacespacespacespace

ISSUE
spacespacespacespacespace

High

RDFI Liability – In alignment with the processing of Federal tax refunds, if a financial institution posts an Entry based on the information in the Entry without touching it, by posting it to the exact account number in the Entry, it will face no liability.

If the institution moves the Entry to an account other than the account in the actual Entry, either automatically or by manual manipulation, the financial institution will most likely be liable for any error. That would include manual posting, causing the error or use of “swap tables”.

Reputational Risk – This is perhaps the most sensitive issue that may develop in processing EIPs. This is also where the institution may need to revisit current policies and procedures. If the institution has taken action in the past or has been informed of any of these (or other) issue previously, what actions has the institution taken to prevent them from happening again?

Combining these unprecedented times and the actions initiated as a result of COVID-19, along with the ease of communicating via Social Media, it has never been easier for disgruntled account holders to share their story far and wide within your community. Great care should also be taken in sharing your responses throughout the institution including any customer/member facing department, so the response of your institution is unified in its distribution.

IMPACT spacespacespacespacespace	ISSUE spacespacespacespace
HIGH	Account Holder/Tax Preparer Error – This often happens when the preparer is working with its taxpayer and asks the questions, “Has anything changed?”, and the taxpayer, forgetting that a divorce is final or that he or she changed bank accounts, answers “No”, the payment could end up in the ex-spouses account or a partner’s account inadvertently. Based on the information above, this is not the RDFIs regulatory problem, but it could be a reputational problem. The institution will need to determine what actions to take even if that answer is none.
HIGH	Right to Offset – if your institution has the right of offset disclosed to your accountholders, the EIPs may be used for that purpose, to offset an outstanding obligation. In the spirit of the Regulation, your institution may want to consider what impact offsetting any of the EIPs may have on your reputation. Even if 99% of accountholders are happy that they received 90% of their stimulus payments, the Social Media attacks of even 1% of accountholders could have a lasting and bruising affect on your reputation in the community. This is a consideration when considering reputational risk.
HIGH	Overdrawn Accounts – As with the right to offset, other members have indicated that they are seeking a way to make the EIP fully available, even for overdrawn accounts. Institutions may want investigate if there are way to accommodate this systemically or on a one-off basis. This is a consideration when considering reputational risk.
MEDIUM	*Inconsistent information being shared by customer/member facing staff*. The bank or credit union should ensure that all staff fully understand policy decisions related to the EIP payments. Customers receiving different information from different employees about what happened or what will happen next will only increase the reputational risk to the bank.

Fraud Risk - We have seen throughout history that during crisis fraud increases. You and your teams will be under great pressure to make quick decisions to ensure people needing their funds receive them. You have staffing levels that are not normal and employees working remotely. People work and react differently under stress and that is what the fraudsters take advantage of.

IMPACT
spacespacespacespacespace

ISSUE
spacespacespacespace

High

Fraudulent checks – Not all EIP payments will be made via direct deposit. Some of your account holders will be receiving checks and the fraudsters know that.

Think about how your branches are operating right now, with long lines in the drive through and frontline staff dealing with their own personal stress and taking on the stress of customers who maybe in very dire economic circumstances. This is a recipe for fraudsters trying to pass bad checks. http://TCVA.Fiscal.Treasury.Gov is a site for validation that can be used by your employees. Share that information with branch personnel.

Also, with mobile RDC, you need to be on the look out for duplicate deposits. Please ensure your staff is on heightened alert.

High

Multiple EIP direct deposits into a single account. We know that there is rampant fraud in the tax return process and the Treasury is following that same process to issue EIP payments.

You may have accounts that have been used in the past to receive multiple tax returns and now those account may have multiple EIP deposits. Accounts receiving multiple deposits should be reviewed and requests for ACH transfers and wires from those accounts should get a second review.