Payment Risk Management Chip Martin Bottomline Technologies

2 Agenda The Compliance Climate Risk Management Overview Government Regulations Other Payment Risk Factors Best Practices & Benefits Questions

3 The Compliance Issue In 2005 alone, firms expect to spend $15.5 Billion on a wide range of compliance programs. $80 Billion, in next 5 years.

4 Compliance: Problem or Opportunity? Compliance can be an Opportunity if you use mandates to improve business processes. –Consider and track return on investment To succeed, find balance between: –Performance Objectives –Compliance Requirements –Risk Mitigation

5 Risk Mitigation for Payments Visibility – Do you know who you are paying? Fraud – In the U.S. alone, $42 million bad checks are passed every month costing more than $19 billion a year.* Goals: –Identify risk and prevent loss before it occurs –Implement best practices and use tools that allow security officers and financial managers to identify and manage improper payments. * NACHA Industry Report, 2004

6 Government Regulations: OFAC Treasury’s Office of Foreign Asset Control’s (OFAC) –Enforce economic and trade sanctions put in place by the US government against certain individuals, entities and countries. It is illegal to pay any individual, entity or country identified by OFAC. The Specially Designated Nationals (SDN) is OFAC’s list –Individuals –Companies –Government entities

7 OFAC’s SDN List Presently consists of more than 5,000 entries including known terrorist organizations. –Advanced Electronics Development –American Air Ways Charters, Inc. –Atlas Equipment Company, Ltd. –Global Relief Foundation, Inc. –TNK Fabrics Limited –Technic Digimex Corp.

8 Fined in 2004 for paying SDN’s Bristol-Myers Squibb Daimler-Chrysler North America Holding Company The Salvation Army Fort Dodge Animal Health Falcon Chemical Corp.

9 OFAC – Your Responsibility OFAC does not mandate compliance procedures OFAC simply enforces the embargos and sanctions If your company pays someone on the SDN list there will be civil or criminal penalties. If you can demonstrate that you have –made an effort to comply with the laws or –have a documented compliance program in place the penalties may be mitigated.

10 Government Regulation: The Patriot Act Effective October 2001 Broadened the scope of the 1970 Bank Secrecy Act’s (BSA) recordkeeping and reporting requirements. Requires special due diligence for banking relationships involving foreign people or financial institutions. Increased the penalties for money laundering from $100,000 to $1,000,000.

11 Patriot Act Financial institutions must establish Anti-Money Laundering (AML) programs and customer identification programs. Minimum requirements for all financial institutions: –Develop internal policies, controls and procedures –Designate a financial compliance officer –Establish ongoing employee training –Conduct an independent audit to ensure that procedures are being followed

12 The Patriot Act – broader scope New entities are now included in the term “Financial Institutions” and the Treasury Dept has the authority to add others. –Car, plane and boat dealers –People engaged in Real Estate closings –Insurance Companies –Dealers of precious metals, stones, jewels –Travel agencies –Casinos –Foreign Currency Exchanges

13 Sarbanes Oxley Effective July 2002 To combat the wave of accounting and reporting scandals and corporate bankruptcies. Requires more detailed and accurate financial reporting and disclosure from publicly traded companies. Focuses on conduct of senior management, officers and accounting firms.

14 Manage Other Risk Factors Prevent employee or internal fraud Catch duplicate payments Monitor payee address Unreliable vendors

15 Best Practices for Risk Management Name variations Criminals can very easily use variations or initials to avoid detection In addition to simple direct name matching there are offerings with extraordinary name variation capabilities Using a solution which provides a comprehensive algorithm, you can generate hundreds of name variations for one individual on the SDN list

16 Risk Management - Payment Gateway

17 OFAC Risk Management in action

18 Best Practices for Risk Management Know with whom you do business, even subsidiaries as they could have operations in one of the prohibited countries. Establish a payment gateway - - implement procedures and software tools to reduce the effort Report on every possible match or suspect payment (and the action taken) to show due diligence at a compliance audit

19 Benefits of Risk Management Identify and monitor potentially serious fraud early Go above and beyond SDN list for OFAC compliance and fraud prevention Gain more control, especially in International Markets

20 Conclusion Companies are realizing the “tough love” regimen imposed by compliance can lead to long-term benefits in terms of improved business performance - Gartner