Banking Law

A couple of years ago, I took David Peterson to task for saying that there was "zero risk" in remote deposit capture technology. Well, "take to task" is a bit mild. Actually, I was a snarky little snot who suggested that David, at the time a founder and senior executive of Goldleaf Technologies, a company that sold RDC technology and services to banks, was angry with banks for not adopting RDC more quickly because it was hurting his company's bottom line.Then again, as a number of my critics have pointed out, I never go slowly when damn-the-topedoes-full-speed-ahead is an option.

I had drinks and dinner with David a couple of weeks ago at the BAI Retail Delivery conference in Las Vegas, and he (actually he and a business partner of mine, Erin Handel, CEO of Bankerstuff.com) reminded me of my smack down of David. Erin actually produced my post on her iPad (damn this technology!). Although he sold Goldleaf Technologies to Jack Henry & Associates (it is now a division called Profitstars), he's still actively involved in RDC and writes a blog, RDsaw (a take-off on RD"C"), at remotedepositcapture.com. He's also still a true believer in RDC and believes that the perceived risks are overblown, that FFIEC guidance on RDC is misguided, and that banks are doing themselves and their customers a disservice by not adopting the technology much more rapidly than they have been.

While I remain unconvinced that a cautious approach to the implementation RDC is a mistake, David has staunch supporters on his side. Moreoever, he was such a good sport about my blog-bashing that I offered him an opportunity to respond on my blog with a guest post. So, here it is, readers, uncut and unedited.

***************************************************************************************************************************

From my article, 7 Secrets of Successful RDC FIs, Secret #1 was that successful FIs find ways to get RDC in use rather than restrict RDC access.  I am completely befuddled on how this issue is even a question amongst bankers and those that regulate them.  Yet in the FFIEC Examiner Handbook, Appendix A, section N3 (page 110) suggests that FIs need to a) qualify prospects, b) perform an "information" review, and c) review the customer?s security infrastructure prior to initiation of RDC.  Now I will be the first to agree that FIs need to be concerned with the computers on which clients are conducting RDC.  Many companies do not have the same systemic approach for virus protection as FIs. This leaves them open to key loggers and other malware, infecting their computing devices and that can have a negative affect on any banking functions performed on them including RDC.  Setting aside this corporate account takeover issue (after all, if my computer gets hacked and someone has access to my Remote Capture, all they can do in deposit into my account!) My issue is why many regulators and FIs are taking the comments in the FFIEC guidance as a mandate to "limit" RDC use.  The underlying presumption is that RDC is ?risky? and should therefore be limited as to who gets access.  My question is this "If any person or customer opens an account at your institution, and they can come into any of your branches and deposit any forward presentable items, under what circumstances would you decide that they were not able to participate in your RDC service??  While I have asked this question in numerous venues, I have yet to have anyone come up with any reasonable response.  In discussions with examiners, the reasons they give as to why this was included are scanning fraudulent items; concerns over the capability of the users at the business and the quality of the resulting check images.  Let me address each of these in turn:

Fraudulent Items - The issue is whether an RDC customer would create a fraudulent item or inadvertently allow a fraudulent item to be scanned.  Is this possible?  Of course!  The real issue is whether scanning at a customer's location INCREASES the likelihood that a fraudulent item would be deposited.  I contend not, primarily due to the fact that this argument assumes that deposited items would receive more scrutiny if the deposit occurred at a branch location.  This is not the case.  Items deposited at branches are most likely going to be immediately scanned by the teller and then put aside.  Even if an FI is not doing front counter capture, no one is examining these items in the back-office!  I contend that with the fraud prevention tools that are being used by most RDC systems, the items scanned at remote locations receive more scrutiny than one presented in person at a branch.

Bad Scans - OK, this could be an issue.  Most FIs provide little if any training to their customers on how to use the tools they provide them and certainly don't follow up to ensure they are getting it right (or doing preventative maintenance on their scanners, or securing the source documents ?).  But to assume that customers don?t get scanning right would be incorrect. In fact, the RDC services offered by nearly all FIs guide and direct the customer to get the images right.  If there is a situation where an item is incorrectly scanned, the customer will not get credit for that item, generally guaranteeing that they will figure it out the problem before making a future deposit.  Moreover, if there were an issue with bad scans (and fraudulent items for that matter), there would be a significant number of RDC items being returned.  The fact that the return percentage is infinitesimally small indicates that neither of these is an issue.

If a customer is given RDC and subsequently they are caught attempting to use RDC in a manner other than allowed, you THEN restrict their use of RDC.  If a customer constantly makes operational errors, and additional training cannot remediate the issue, that would be a good reason to remove RDC from that customer.  It is the customer?s own behavior that might cause them to lose their RDC "privileges".  For those that would say that the credit quality of the customer should be factored in I say, "If a customers credit is compromised and you thus restrict RDC, are you still allowing them to deposit with you"?  Are you going to shut down their account? If not, then use the controls that your RDC service allows to the number of amount of items they deposit and setup other red flag alerts within all systems that you are using to track customer activity and then take immediate action if you see that a customer is not using your tools correctly.  RDC does not introduce any additional risk in the deposit process.  Examiners should be encouraging, not discouraging RDC use.

Some experts (including my esteemed collogue that writes in this space) would argue that it is BECAUSE of the scrutiny and heightened sense of perceived risk that has led to so few fraudulent items being presented.  I disagree.  Crooks find the cracks in the system, the nuances that allow them to use a system for their illicit activities. The fact that there is literally no fraud indicates exactly what I have been saying all along; there is no increased risk in RDC over traditional deposits.  The fact that some FIs have allowed perceived risk to slow down their deployment only allows other FIs or ISOs disintermediation to occur.  RDC is the most dynamic service available to banks in the past 30 years.  It enables customers to do a deposit at a time and place of their choosing. Vendors have created a plethora or security and customer management tools that allow RDC to be performed safely and accurately.  Since the FFIEC guidance will require you to create a useless file of documentation on each RDC user, I say do this due diligence, make the files, and when the regulators come in, pile up the hundreds of files representing your RDC users and let the examiners have fun sifting through looking for an RDC user that shouldn't "qualify".

Or maybe I have it all wrong.  I welcome your comments at david@i7strategies.com.  Thanks Kevin for the opportunity to opine on this subject.
---David Peterson