Checking In on Check 21: Risks Associated with Increased Use of Remote Deposit Capture

Author: Nathan Danielson – Published in the October 2013 issue of the Indiana Bankers Association Hoosier Banker.

 

The first word that comes to mind when turning one’s attention to the check processing system utilized by banks might not be “innovation”. Nevertheless, in the late 1990s and early 2000s, vulnerabilities in the established check processing system were exposed, and innovation was deemed necessary.

 

On October 28, 2004, the “Check Clearing for the 21st Century Act” (also known as “Check 21”) went into effect. Check 21 is implemented by Subpart D to Federal Regulation CC. Prior to Check 21, it was necessary to move original paper checks from the banks where they were deposited to the banks that paid them. Check 21 was designed, in part, to enhance the efficiency of the check processing system by facilitating check truncation and encouraging the use of electronically-processed checks.

 

Under Check 21, banks and other parties can “truncate” an original check, thereby removing it from the check collection process, and after capturing a digital image of the front and back of the check, along with other necessary information, transmit the information to a recipient without the necessity of delivering the original check. Check 21 also facilitates “remote deposit capture” (also known as “RDC”) by banking customers who convert original checks to digital images, and provide the images and digital check information to banks in lieu of original paper checks.

 

If a bank or its customer requires a paper check, the electronic picture and payment information for the truncated check can be used to create a paper “substitute check”. Provided the requirements of Check 21 are followed, a bank can then deliver the substitute check, which includes all of the information contained on the original check, to a bank that wants to continue receiving paper checks. Check 21 makes a substitute check the legal equivalent of the original check and requires banks to accept substitute checks; however, it does not require banks to truncate checks.

 

Utilizing the truncation process permitted by Check 21 has many benefits, including but not limited to:

• Cutting expenses and risks of human error associated with handling and processing paper checks;

• Increasing the speed of the collection and return process; and

• Providing flexibility to customers both with regard to processing deadlines and methods of deposit, including RDC.

 

Using the procedures permitted by Check 21 does have some drawbacks. The law, together with its implementing regulations, created warranties and indemnifications which come into play when something goes wrong with a substitute check. These warranties and indemnifications travel with the substitute check and reach back to the so-called “reconverting bank”. (The bank of first deposit will be considered the “reconverting bank” if it creates the substitute check or if its depositor creates the substitute check which is then transferred or presented by the deposit bank.)

 

Generally, the Check 21 warranties provide that (i) no party will be asked to make a duplicate payment on a check that has been paid, and (ii) the substitute check meets all requirements, and contains all information necessary, for legal equivalence. The Check 21 indemnifications are provided to all parties in the collection or return stream for losses incurred due to the receipt of a substitute check which would not have occurred with an original check.

 

It is not hard to imagine a scenario where a dishonest depositor takes advantage of RDC to the detriment of a reconverting bank. The depositor could, for example, truncate a check, sending an electronic version of the check to two different banks. If each bank uses the information it receives to create substitute checks, and both substitute checks are presented to a third bank, then both of the presenting banks would be reconverting banks. If both checks are paid by the third bank, the third bank likely would be able to pursue a claim against either of the reconverting banks for any loss it suffers due to duplicate payment. Cases of forgery, where a party in the payment stream suffers losses because it is not able to tell from a substitute check that a signature is forged, present similar risks to reconverting banks.

 

On January 14, 2009, the Federal Financial Institutions Examination Council (FFIEC) issued guidance suggesting how financial institutions should design and implement a program aimed at assessing and managing risks associated with RDC (referred to herein as the “FFIEC Guidance”). The FFIEC Guidance suggests that each institution manage RDC risk via what amounts to a three step process: (1) assess risks posed by that institution’s particular RDC implementation; (2) implement controls to mitigate identified risks; and (3) implement systems to measure and monitor the implemented controls.

 

RDC risks vary by institution, but issues to be considered might include:

• legal and compliance concerns-with regard to applicable law and regulations as well as direct exchange agreements;

• information technology limitations;

• availability of multi-factored authentication, layered security, or other controls-particularly in connection with RDC use which incorporates Internet connections;

• analysis of the customer base; and

• secrecy and privacy concerns-including with regard to the institution’s method of capturing, transmitting, retaining, and destroying private information.

 

Once risk is assessed, controls and systems are necessary to address the identified risks. Some specific items recommended in the FFIEC Guidance include:

• limiting the availability of RDC to a select group of customers;

• utilizing a customer agreement which clearly defines, among other things, the roles of the parties, what procedures the customer must follow, what supporting documentation the customer must provide, and how liability will be allocated among the parties;

• requiring that customers utilizing RDC implement their own operational and risk monitoring controls;

• utilizing a suitable and reputable vendor which provides technology services to institutions utilizing RDC;

• educating customers and providing training to customers in connection with the institution’s RDC system; and

• obtaining and maintaining suitable and applicable insurance coverage for RDC losses.

 

Check 21 opened a window to increased efficiency through check truncation and increased reliance on electronic check processing. More prevalent utilization of RDC is just one of the innovations encouraged by Check 21. Although there are many advantages to the flexibility provided by Check 21 and RDC, there also are risks. Banks should stay abreast of developments in these areas, analyze risks, and implement controls and systems to help mitigate associated losses.