IBA Compliance Connection

Your go to source for compliance!

Our examiners and auditors want us to create a mobile banking policy. Do you have any samples?

—

by

admin

We have attached sample remote deposit capture policies that we pulled from the ABA’s online compliance forum — we could not locate any policies that covered mobile banking in general. While we did not write these policies and cannot vouch for their accuracy, they may be helpful as a starting place for writing your own institution’s policy. With that said, we strongly recommend creating an individualized policy for your bank that reflects your mobile banking processes and your institution’s risks, as we discuss below.

The federal banking agencies have released plenty of guidance on mobile banking, remote deposit capture, and related issues, which we link to below. As an example, the FFIEC’s Risk Management of Remote Deposit Capture provides an excellent overview of the legal, compliance, and operational risks involved in remote deposit capture (RDC) (a term that includes payments via mobile phone). As stated in the guidance, “[r]isks may differ if the institution uses image exchange for a portion of the process or elects to use the ACH network throughout,” and different risks apply depending on whether you use a third-party service provider for some or all of your mobile banking services. For those reasons, your policy must reflect your institution’s mobile banking program (taking into account image exchange versus ACH network transactions, third party vendor risks, etc.).

The FFIEC guidance also includes some specific statements about developing mobile banking policies and procedures:

  • Page 2: An institution’s board or management should approve RDC policies and procedures
  • Page 4: Policies and procedures should include risk mitigation and controls (which, as noted on page 5, could include risk tolerance levels, internal procedures and controls, risk transfer mechanisms where appropriate and available, and well-designed contracts that meet the institution’s risk management needs)
  • Pages 5­–8: Some areas you may want to cover in a mobile banking policy include customer due diligence, vendor due diligence, customer training on RDC, contracts and agreements, and business continuity

There are many other resources from the federal banking agencies that you may want to examine as well:

Interagency/Federal Financial Institutions Examination Council (FFIEC)

Federal Deposit Insurance Corporation (FDIC)

Federal Reserve Board (FRB)