US OCC Issues Guidance to Banks Regarding Payment Processors

The US Office of the Comptroller of the Currency late last week issued new risk management guidance to bnks onthe subject of payment processors. The OCC said that 'certain merchants, such as telemarketers, pose a higher risk than other merchants and require additional due diligence and close monitoring.

The OCC has seen a variety of relationships between banks and processors in which the processor uses its bank relationship to process payments for merchant clients. Often the processor uses a bank account as the vehicle to conduct such payment processing. For example, a processor may be a bank customer that deposits into its account RCCs generated on behalf of merchant clients. A processor may also act as a third-party sender of ACH transactions, originating debits for its merchant clients through its customer relationship with the bank. In either case, the bank often has no direct customer relationship with the merchant. Risks are heightened when neither the processor nor the bank performs adequate due diligence on the merchants for which they are originating payments.

When a bank has a relationship with a processor, it is exposed to risks that may not be present in relationships with other commercial customers. The bank encounters strategic, credit, compliance, transaction, and reputation risks in these relationships. Banks have two distinct areas of responsibility to control these risks. The first is due diligence and underwriting, and the second is monitoring these high-risk accounts for high levels of unauthorized returns and for suspicious or unusual patterns of activity. Proper initial due diligence, effective underwriting, and ongoing account monitoring are critical for bank safety and soundness and consumer protection. Banks should implement these controls to reduce the likelihood of establishing or maintaining an inappropriate relationship with a processor through which unscrupulous merchants can gain access to consumers’ bank accounts.

Banks should also consider carefully the legal, reputation, and other risks presented by relationships with processors including risks associated with customer complaints, returned items, and potential unfair or deceptive practices. Banks that do not have the appropriate controls to address the risks in these relationships may be viewed as facilitating a processor’s or its merchant client’s fraud or other unlawful activity. Banks should be alert for processors that use more than one bank to process payments for merchant clients and should subject such processors to great scrutiny. Processing through multiple banks may be a signal that the processor recognizes a risk that one or more of these processing relationships may be terminated as a result of suspicious, fraudulent, or other unlawful conduct.