Financial institutions compete for new customers to grow core deposits and Tier 1 capital. Easy and frictionless account opening and funding complements this objective. Unfortunately, losses from account opening fraud works against it. As Account-to-Account (A2A) funding frauds take their toll, FIs are learning to balance the business need for new deposits against risk controls on these new deposits.

Members of Nacha’s Risk Management Advisory Group (RMAG) met recently and discussed the challenges faced by financial institutions looking for new customers. Each FI wants to provide the best customer service to depositors while keeping fraudsters out of the system. RMAG members discussed effective controls and the potential negative effects for depositors imposed by each control. Financial institutions need to consider the benefits and the risks of each control when deciding how to manage new accounts and attract new deposits. Three controls received consideration: holds on newly-deposited funds; requiring funding by transactions pushed from an external account; and a cap on deposits until the depositor has established a history of successful transactions on the new account. Nacha and the RMAG do not take a position on the controls FIs implement around the funding of new customer accounts but would like you to consider the following options.

Account Holds

The Nacha Rules and Regulation CC define how quickly a financial institution must make funds available to account holders who receive incoming ACH credits. Availability on inbound funds pulled in by an ACH debit (as opposed to an ACH credit) are not addressed by these rules. Therefore, an FI that pulls funds into a depositor’s new account (as the ODFI of an ACH debit) can place a hold on the funds before making them available to the depositor. Hold terms must be clearly stated in the agreement with the account holder. They cannot be issued spontaneously or retroactively.

FIs could set limits and holds for A2A funding and subsequent withdrawals in the same way they think of other limits and holds. Most FIs have debit card limits and set limits on transactions customers can make at an ATM. These controls should work in concert and align with the institution’s risk appetite.

As an extreme example, a 60-day hold on new deposits would completely protect the FI from the risk of the debit being returned, whether due to insufficient funds or the account holder’s claim that the debit was unauthorized. However, a 60-day hold on all new deposits would not be consumer-friendly. Few new customers would likely place new deposits with a bank or credit union that follows this policy.

More reasonable hold options include longer holds on new deposits above a specified threshold. For example, providing relatively quick access to the first $1,000 deposited, but placing a longer hold on any amount above this threshold. Hold times can be set by the FI and made long enough that it feels comfortable with the risk of releasing the funds. Partial availability of funds can be made relatively quickly, with the balance of funds held for a longer period. Each FI must determine its own hold periods and minimum balance requirements, and weigh these against risk tolerances as well as what consumers will find acceptable. [1]

Require Funding through Credit-Push Deposits

An alternative to funding deposits by initiating ACH debits is to provide the Routing and Transit Number (RTN) and new account number to the consumer and asking them to initiate a credit push payment, such as an ACH credit, from another account they own. This control could be enacted on all deposits above a predetermined threshold. Funding a new account in this manner provides greater assurance of finality, and therefore quicker access to funds for the consumer. Additionally, it eliminates the 60-day risk of unauthorized returns. All credit deposits received are subject to the funds availability requirements of the Nacha Rules and Regulation CC. The quick access to funds for the consumer sending a credit push transaction into the new account should be weighed against the lack of consumer return rights that exist when funding the new account using a debit transaction.”

There are three main drawbacks to requiring consumers to push a credit payment from another FI to fund a new account: 1) the FI seeking the new deposits is reliant on the consumer to follow through with funding the new account; 2) the counterparty FI which the customer currently has a relationship with may not offer a credit-push service to its consumer customers; and 3) the consumer may feel that it’s too complicated and give up. FIs deploying this control should expect some failure rate for consumers that do not follow through.

Limit Deposits Until the Consumer Establishes an Account History

FIs can limit the risk of new account abuse by capping the value of new deposits until a customer has established a history of transactions at that bank or credit union. FIs can use AI and active learning to determine if the activity is normal before granting a larger deposit limit. AI and automation can be assigned tasks too numerous for a human. Tools can be used to identify outliers that can be escalated and reviewed by bank staff. These can include 1) tools to understand if the new customer is acting in an expected manner for the account balances deposited; 2) review that the transactional velocity is typical for an account holder; and 3) determine if the consumer is receiving employment Direct Deposits through the new account and is paying bills.

An FI can better ensure large deposits will not immediately flow out to another outside account by limiting the amount a consumer can deposit. Capping the value of new deposits comes at the risk of frustrating consumers who want to move quickly away from another FI and use your bank or credit union as their primary transaction account.

Determining the Right Solution

FIs are the target of fraudsters. They also are competing in the market to attract new customers and deposits. Controls help mitigate fraud.  Excessive friction from controls discourages legitimate new account holders from moving new balances to your FI. What is the right balance of controls and friction to encourage a good customer experience while keeping fraudsters from taking advantage? That decision is up to each FI.

Fraudsters are using their real identities to open new accounts and pass know your customer (KYC) requirements. RMAG members encourage FIs to report potential criminal activity to law enforcement authorities and let fraudsters know that any intentional attempt to obtain money from a financial institution by misrepresenting whether a transaction was authorized may result in the imposition of fines up to $1,000,000, or imprisonment up to 30 years, or both under the provisions of Federal law (18 U.S.C. §1344).

[1] In considering longer holds on funds in a deposit, it is important to know exactly how the account funding transaction is routed. An FI that outsources this function might in fact be the recipient of an ACH credit from the processor.  In this case, the full amount of the funding transaction is subject to the funds availability requirements of the Nacha Rules and Reg CC, while still subjecting the FI to return risk by the processor.  RMAG thinks a better solution is for the FI to create its own an ACH debit to the Receiver’s account at the RDFI, and credit the account holder via an internal book transfer.